24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious DeepScan:Generic.Remcos Sample 3696d769fc0c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3696d769fc0c…. Malware family: DeepScan:Generic.Remcos. Threat score 100/100. 8/28 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472","keywords":["Malicious","DeepScan:Generic.Remcos","malware analysis","sandbox report","threat intelligence","3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472"],"about":{"@type":"SoftwareApplication","name":"TNT Original Invoice PDF.exe","applicationCategory":["peexe","executable"],"identifier":"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"DeepScan:Generic.Remcos","antivirusDetections":{"malicious":8,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T976,Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_Lue" (Indicator: "FreeLibrary") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueO" (Indicator: "FreeLibrary") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary") in Source: 00000000-00007256-00000C1E-7383339126:Td84,Observed string: "e East Standard TimeNew Zealand Standard TimeNorth Korea Standard TimeSouth Sudan Standard TimeTransbaikal Standard TimeUS Mountain Standard TimeUlaanbaatar Standard TimeUpdateProcThreadAttributeVladivostok Standard TimeW. Mongolia Standard Time_cgo_thread_start missingallgadd: bad status Gidlearena already initializedbad status in shrinkstackbad system huge page sizechansend: spurious wakeupcheckdead: no m for timercheckdead: no p for timerinconsistent poll.fdMutexinvalid cross-device linkmissing stack in newstackmissing traceGCSweepStartno buffer space availableno such device or addressoperation now in progressreleasep: invalid p stateremaining pointer buffersresource deadlock avoidedruntime: VirtualAlloc of runtime: program exceeds runtime" (Indicator: "VirtualAlloc") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "SA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeUS Eastern Standard Timebad defer entry in panicbypassed recovery failedcan't scan our own stackconnection reset by peerdouble traceGCSweepStartflate: maxBits too largefunction not implementedgcDrainN phase incorrecthash of unhashable type level 2 not synchronizedlink number out of rangenot supported by windowsout of streams resourcespageAlloc: out of memoryqueuefinalizer during GCrange partially overlapsreflect.Value.SetComplexrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningupdate during transitionzlib: invalid dictionary bytes failed with errno= to unused region of span2910383045673370361328125AUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWGODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningrad Standard TimeMidd" (Indicator: "VirtualFree") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin, Observed string: "SA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeUS Eastern Standard Timebad defer entry in panicbypassed recovery failedcan't scan our own stackconnection reset by peerdouble traceGCSweepStartflate: maxBits too largefunction not implementedgcDrainN phase incorrecthash of unhashable type level 2 not synchronizedlink number out of rangenot supported by windowsout of streams resourcespageAlloc: out of memoryqueuefinalizer during GCrange partially overlapsreflect.Value.SetComplexrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningupdate during transitionzlib: invalid dictionary bytes failed with errno= to unused region of span2910383045673370361328125AUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWGODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningrad Standard TimeMiddl" (Indicator: "VirtualFree") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin27:T1027,Observed string: "Standard TimeAstrakhan Standard TimeCertGetCertificateChainDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeLogical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeRtlGetNtVersionNumbers" (Indicator: "GetSystemTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "ble byte arrayruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %ytried to sleep scavenger from another goroutineCreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfail to read symbol table: %d aux symbols unreadnot enough significant bits after mult64bitPow10runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=slice bounds out of range [:%x] with capacity %ystrconv: illegal AppendFloat/FormatFloat bitSizecasgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough significant bits after mult128bitPow10panicwrap: unexpected string after package name: reflect.Value.Slice: slice of unaddressable a" (Indicator: "GetSystemTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "ble byte arrayruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %ytried to sleep scavenger from another goroutineCreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfail to read symbol table: %d aux symbols unreadnot enough significant bits after mult64bitPow10runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=slice bounds out of range [:%x] with capacity %ystrconv: illegal AppendFloat/FormatFloat bitSizecasgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough significant bits after mult128bitPow10panicwrap: unexpected string after package name: reflect.Value.Slice: slice of unaddressable ar" (Indicator: "GetSystemTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00007256-00000C1E-73834172 Observed string: "West Asia Standard TimeWest Bank Standard Time" missing CPU supportbytes.Buffer: too largechan receive (nil chan)close of closed channeldevice or resource busyfatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = left over markroot jobsmakechan: bad alignmentmissing type in runfinqnanotime returning zerono space left on deviceoperation not permittedoperation not supportedpanic during preemptoffprocresize: invalid argreflect.Value.Interfacereflect.Value.NumMethodreflect.methodValueCallruntime: internal errorruntime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding locksshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (work.nwait > work.nproc116415321826934814453125582076609134674072265625Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin28:Tfd0,Observed string: "Standard TimeAstrakhan Standard TimeCertGetCertificateChainDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeLogical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeRtlGetNtVersionNumbers" (Indicator: "GetSystemTimeAsFileTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "ble byte arrayruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %ytried to sleep scavenger from another goroutineCreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfail to read symbol table: %d aux symbols unreadnot enough significant bits after mult64bitPow10runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=slice bounds out of range [:%x] with capacity %ystrconv: illegal AppendFloat/FormatFloat bitSizecasgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough significant bits after mult128bitPow10panicwrap: unexpected string after package name: reflect.Value.Slice: slice of unaddressable a" (Indicator: "GetSystemTimeAsFileTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "ble byte arrayruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %ytried to sleep scavenger from another goroutineCreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfail to read symbol table: %d aux symbols unreadnot enough significant bits after mult64bitPow10runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=slice bounds out of range [:%x] with capacity %ystrconv: illegal AppendFloat/FormatFloat bitSizecasgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough significant bits after mult128bitPow10panicwrap: unexpected string after package name: reflect.Value.Slice: slice of unaddressable ar" (Indicator: "GetSystemTimeAsFileTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "West Asia Standard TimeWest Bank Standard Time" missing CPU supportbytes.Buffer: too largechan receive (nil chan)close of closed channeldevice or resource busyfatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = left over markroot jobsmakechan: bad alignmentmissing type in runfinqnanotime returning zerono space left on deviceoperation not permittedoperation not supportedpanic during preemptoffprocresize: invalid argreflect.Value.Interfacereflect.Value.NumMethodreflect.methodValueCallruntime: internal errorruntime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding locksshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (work.nwait > work.nproc116415321826934814453125582076609134674072265625Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin29:T1027,Observed string: "Standard TimeAstrakhan Standard TimeCertGetCertificateChainDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeLogical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeRtlGetNtVersionNumbers" (Indicator: "GetSystemTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "ble byte arrayruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %ytried to sleep scavenger from another goroutineCreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfail to read symbol table: %d aux symbols unreadnot enough significant bits after mult64bitPow10runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=slice bounds out of range [:%x] with capacity %ystrconv: illegal AppendFloat/FormatFloat bitSizecasgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough significant bits after mult128bitPow10panicwrap: unexpected string after package name: reflect.Value.Slice: slice of unaddressable a" (Indicator: "GetSystemTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "ble byte arrayruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %ytried to sleep scavenger from another goroutineCreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfail to read symbol table: %d aux symbols unreadnot enough significant bits after mult64bitPow10runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=slice bounds out of range [:%x] with capacity %ystrconv: illegal AppendFloat/FormatFloat bitSizecasgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough significant bits after mult128bitPow10panicwrap: unexpected string after package name: reflect.Value.Slice: slice of unaddressable ar" (Indicator: "GetSystemTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00007256-00000C1E-73834172 Observed string: "West Asia Standard TimeWest Bank Standard Time" missing CPU supportbytes.Buffer: too largechan receive (nil chan)close of closed channeldevice or resource busyfatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = left over markroot jobsmakechan: bad alignmentmissing type in runfinqnanotime returning zerono space left on deviceoperation not permittedoperation not supportedpanic during preemptoffprocresize: invalid argreflect.Value.Interfacereflect.Value.NumMethodreflect.methodValueCallruntime: internal errorruntime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding locksshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (work.nwait > work.nproc116415321826934814453125582076609134674072265625Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin2a:T559,".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007256) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007256) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007256) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007256) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007256) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007256) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007256) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007256) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007256) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007256) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007256) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007256) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007256)2b:Tde9,Observed string: "mstartbad sequence numberbad value for fieldbinary.LittleEndiandevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625AgHazncIvrjBsFrpgvbaAgJevgrIveghnyZrzbelArabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddres" (Indicator: "CreateProcess") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "mstartbad sequence numberbad value for fieldbinary.LittleEndiandevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625AgHazncIvrjBsFrpgvbaAgJevgrIveghnyZrzbelArabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddress" (Indicator: "CreateProcess") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625AgErfhzrGuernqCertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIveghnyNyybpRkMB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriod" (Indicator: "CreateProcess") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "syscall.CreateProcess" (Indicator: "CreateProcess") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin2c:Tbf5,Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_Lue" (Indicator: "CreateFile") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueO" (Indicator: "CreateFile") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "CreateFileA" (Indicator: "CreateFile") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "wrong medium type but memory size because dotdotdot in async preempt to non-Go memory , locked to thread298023223876953125AgFrgPbagrkgGuernqAgTrgPbagrkgGuernqArab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWIran Standard TimeLookupAccountNameWOmsk Standard TimeRFS specific errorRegional_IndicatorRussia Time Zone 3SetFileAttributesWSystemFunction036" (Indicator: "CreateFile") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin2d:Td6c,Observed string: "edx eflags eip esi esp fs gs no anodepollDescreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.traceBuftrigger=unknown(wsaioctl (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA (MISSING)(unknown), newval=, oldval=, size = , tail = 244140625: status=Bassa_VahBhaiksukiCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyreneParseUintSamaritanSundaneseWSASendToWriteFileagqyy.qyyatomicor8bad indirchan sendcomplex64copystackctxt != 0funcargs(hchanLeafinittraceinterfaceinvalid nmSpanDeadntdll.dllpanicwaitpclmulqdqpreemptedprofBlockpsapi.dllrecover: reflect: scavtracestackpooltracebackwbufSpans} stack=[ MB goal, flushGen gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)(BADINDEX), bound" (Indicator: "MoveFile") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_Lue" (Indicator: "MoveFile") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueO" (Indicator: "MoveFile") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin2e:T51f,Observed string: "syscall.GetCommandLine" (Indicator: "GetCommandLine") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "too many linkstoo many usersunexpected EOFunknown methodunreachable: unsafe.PointeruserArenaStatewinapi error #work.full != 0 with GC prog476837158203125: no frame (sp=ASCII_Hex_DigitCreateHardLinkWDeviceIoControlDuplicateHandleFailed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWHanifi_RohingyaImpersonateSelfLoadLibraryExA" (Indicator: "GetCommandLine") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "wrong medium type but memory size because dotdotdot in async preempt to non-Go memory , locked to thread298023223876953125AgFrgPbagrkgGuernqAgTrgPbagrkgGuernqArab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWIran Standard TimeLookupAccountNameWOmsk Standard TimeRFS specific errorRegional_IndicatorRussia Time Zone 3SetFileAttributesWSystemFunction036" (Indicator: "CommandLineToArgv") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin2f:T64e,Observed string: "CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Squareruntime stack:bad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno route to hostnon-Go functionobject is remotereflect mismatchremote I/O errorruntime: addr = runtime: base = runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod" (Indicator: "OpenProcess") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin, Observed string: "ld_PersianOld_SogdianOpenProcessPau_Cin_HauRegCloseKeySetFileTimeSignWritingSoft_DottedVirtualLockWSARecvFromWarang_CitiWhite_SpaceassistQueuebad addressbad argSizebad m valuebad messagebad timedivbroken pipecgocall nilclobberfreeclosesocketcreated by crypt32.dllfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgetpeernamegetsocknameglobalAlloci/o timeoutmSpanManualmethodargs(minTrigger=mswsock.dllnetpollInitreflectOffsruntime: P runtime: g runtime: p scheddetailsecur32.dllshell32.dllshort writetracealloc(unreachableuserenv.dll B (" (Indicator: "OpenProcess") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin30:T8f9,Observed string: "goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollablereleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode xreary32.qyy != sweepgen MB globa" (Indicator: "GetLastError") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollablereleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode xreary32.qyy != sweepgen MB global" (Indicator: "GetLastError") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin31:T1b7f,Observed string:"= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_Lue" that creates/opens a file or I/O device. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_Lue" that closes an open object handle. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueO" that creates/opens a file or I/O device. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueO" that closes an open object handle. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"CloseHandle" that closes an open object handle. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"CreateFileA" that creates/opens a file or I/O device. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"rdtscpselectsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaUNKNOWNWSARecvWSASendtypes value=connectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeCyrillicDuployanEthiopicExtenderGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiParseIntPhags_PaReadFileTagbanwaTai_ThamTai_VietTifinaghUgariticWSAIoctl[signal stack=[cgocheckcs deadlockeax ebp ebx ecx edi" that reads data from a file or I/O device. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"syscall.CloseHandle" that closes an open object handle. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"syscall.ReadFile" that reads data from a file or I/O device. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"wrong medium type but memory size because dotdotdot in async preempt to non-Go memory , locked to thread298023223876953125AgFrgPbagrkgGuernqAgTrgPbagrkgGuernqArab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWIran Standard TimeLookupAccountNameWOmsk Standard TimeRFS specific errorRegional_IndicatorRussia Time Zone 3SetFileAttributesWSystemFunction036" that creates/opens a file or I/O device. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]32:Td953,Found string "edx eflags eip esi esp fs gs no anodepollDescreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.traceBuftrigger=unknown(wsaioctl (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA (MISSING)(unknown), newval=, oldval=, size = , tail = 244140625: status=Bassa_VahBhaiksukiCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyreneParseUintSamaritanSundaneseWSASendToWriteFileagqyy.qyyatomicor8bad indirchan sendcomplex64copystackctxt != 0funcargs(hchanLeafinittraceinterfaceinvalid nmSpanDeadntdll.dllpanicwaitpclmulqdqpreemptedprofBlockpsapi.dllrecover: reflect: scavtracestackpooltracebackwbufSpans} stack=[ MB goal, flushGen gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)(BADINDEX), bound" (Indicator: "FindClose"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "allocated into an arenaruntime.SetFinalizer: pointer not at beginning of allocated blockuser arena chunk size is not a mutliple of the physical page sizebytes.Buffer: UnreadByte: previous operation was not a successful readtoo many concurrent operations on a single file or socket (max 1048575)optional header size(%d) is less minimum size (%d) of PE32 optional headeroptional header size(%d) is less minimum size (%d) for PE32+ optional headerMapIter.Next called on an iterator that does not have an associated map Valuecannot convert slice with length %y to array or pointer to array with length %xQueryPerformanceFrequency syscall returned zero, running on unsupported hardwaresize of data directories(%d) is inconsistent with number of data directories(%d)reflect.Value.Interface: cannot return value obtained from unexported field or methodQueryPerformanceFrequency overflow 32 bit divider, check nosplit discussion to proceedruntime: warning: IsLongPathAwareProcess failed to enable long paths; proceeding in fixup m" (Indicator: "QueryPerformanceFrequency"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "allocated into an arenaruntime.SetFinalizer: pointer not at beginning of allocated blockuser arena chunk size is not a mutliple of the physical page sizebytes.Buffer: UnreadByte: previous operation was not a successful readtoo many concurrent operations on a single file or socket (max 1048575)optional header size(%d) is less minimum size (%d) of PE32 optional headeroptional header size(%d) is less minimum size (%d) for PE32+ optional headerMapIter.Next called on an iterator that does not have an associated map Valuecannot convert slice with length %y to array or pointer to array with length %xQueryPerformanceFrequency syscall returned zero, running on unsupported hardwaresize of data directories(%d) is inconsistent with number of data directories(%d)reflect.Value.Interface: cannot return value obtained from unexported field or methodQueryPerformanceFrequency overflow 32 bit divider, check nosplit discussion to proceedruntime: warning: IsLongPathAwareProcess failed to enable long paths; proceeding in fixup mo" (Indicator: "QueryPerformanceFrequency"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent lockingtimer period must be non-negativetoo many levels of symbolic linksunaligned 64-bit atomic operationwaiting for unsupported file type3552713678800500929355621337890625Other_Default_Ignorable_Code_PointSetFileCompletionNotificationModesVirtualQuery for stack base faileddoaddtimer: P already set in timerforEachP: sched.safePointWait != 0mspan.ensureSwept: m is not lockedout of memory allocating allArenasreflect: Field index out of boundsreflect: Field of non-struct type reflect: string index out of rangeruntime.SetFinalizer: cannot pass runtime: g is running but p is notschedule: spinning with local workslice bounds out of range [%x:%y:]slice bounds out of range [:%x:%y]too many references: cannot spliceunexpected runtime.netpoll error: 1776356839400250464677810668945312588817841970012523233890533447265625attempt to clear non-empty span setencoding/hex: odd length hex stringfile type does not support deadlinefindrunnable: netpoll wi" (Indicator: "VirtualQuery"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent lockingtimer period must be non-negativetoo many levels of symbolic linksunaligned 64-bit atomic operationwaiting for unsupported file type3552713678800500929355621337890625Other_Default_Ignorable_Code_PointSetFileCompletionNotificationModesVirtualQuery for stack base faileddoaddtimer: P already set in timerforEachP: sched.safePointWait != 0mspan.ensureSwept: m is not lockedout of memory allocating allArenasreflect: Field index out of boundsreflect: Field of non-struct type reflect: string index out of rangeruntime.SetFinalizer: cannot pass runtime: g is running but p is notschedule: spinning with local workslice bounds out of range [%x:%y:]slice bounds out of range [:%x:%y]too many references: cannot spliceunexpected runtime.netpoll error: 1776356839400250464677810668945312588817841970012523233890533447265625attempt to clear non-empty span setencoding/hex: odd length hex stringfile type does not support deadlinefindrunnable: netpoll wit" (Indicator: "VirtualQuery"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "Standard TimeAstrakhan Standard TimeCertGetCertificateChainDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeLogical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeRtlGetNtVersionNumbers" (Indicator: "CertGetCertificateChain"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_Lue" (Indicator: "CloseHandle"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueO" (Indicator: "CloseHandle"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "= 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCentral Standard TimeEastern Standard TimeGetProfilesDirectoryWInscriptional_PahlaviLookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNetUserGetLocalGroupsNorfolk Standard TimeOther_Grapheme_ExtendPacific Standard TimeReadDirectoryChangesWRomance Standard TimeRussian Standard TimeSE Asia Standard TimeSaratov Standard TimeYakutsk Standard Timeasync stack too largebad type in compare: block device requiredbufio: negative countcheckdead: runnable gconcurrent map writesdefer on system stackfindrunnable: wrong plink has been severednegative shift amountpackage not installedpanic on system stackpreempt at unknown pcread-only file systemreflect.Value.Complexreflect.Value.Pointerreflect.Value.SetUintreleasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: sear" (Indicator: "AdjustTokenPrivileges"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "= 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCentral Standard TimeEastern Standard TimeGetProfilesDirectoryWInscriptional_PahlaviLookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNetUserGetLocalGroupsNorfolk Standard TimeOther_Grapheme_ExtendPacific Standard TimeReadDirectoryChangesWRomance Standard TimeRussian Standard TimeSE Asia Standard TimeSaratov Standard TimeYakutsk Standard Timeasync stack too largebad type in compare: block device requiredbufio: negative countcheckdead: runnable gconcurrent map writesdefer on system stackfindrunnable: wrong plink has been severednegative shift amountpackage not installedpanic on system stackpreempt at unknown pcread-only file systemreflect.Value.Complexreflect.Value.Pointerreflect.Value.SetUintreleasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searc" (Indicator: "AdjustTokenPrivileges"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "AcquireSRWLockExclusive" (Indicator: "AcquireSRWLockExclusive"; in Source: "00000000-00007256-00000C1E-73835013") Found string "AddVectoredExceptionHandler" (Indicator: "AddVectoredExceptionHandler"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "ard TimeLibya Standard TimeMultiByteToWideCharNepal Standard TimePattern_White_SpaceRussia Time Zone 10Russia Time Zone 11Samoa Standard TimeSetTokenInformationSudan Standard TimeSyria Standard TimeTokyo Standard TimeTomsk Standard TimeTonga Standard TimeWaitForSingleObjectYukon Standard Timeadjusttimers: bad pbad ABI descriptionbad file descriptorbad kind in runfinqbad notifyList sizebad runtime" (Indicator: "MultiByteToWideChar"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "ble byte arrayruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %ytried to sleep scavenger from another goroutineCreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfail to read symbol table: %d aux symbols unreadnot enough significant bits after mult64bitPow10runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=slice bounds out of range [:%x] with capacity %ystrconv: illegal AppendFloat/FormatFloat bitSizecasgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough significant bits after mult128bitPow10panicwrap: unexpected string after package name: reflect.Value.Slice: slice of unaddressable a" (Indicator: "CreateWaitableTimer"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "ble byte arrayruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %ytried to sleep scavenger from another goroutineCreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfail to read symbol table: %d aux symbols unreadnot enough significant bits after mult64bitPow10runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=slice bounds out of range [:%x] with capacity %ystrconv: illegal AppendFloat/FormatFloat bitSizecasgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough significant bits after mult128bitPow10panicwrap: unexpected string after package name: reflect.Value.Slice: slice of unaddressable ar" (Indicator: "CreateWaitableTimer"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "CloseHandle" (Indicator: "CloseHandle"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Squareruntime stack:bad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno route to hostnon-Go functionobject is remotereflect mismatchremote I/O errorruntime: addr = runtime: base = runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod" (Indicator: "CreateDirectoryW"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "CreateEventA" (Indicator: "CreateEventA"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "CreateFileA" (Indicator: "CreateFileA"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "CreateThread" (Indicator: "CreateThread"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "CreateThreadpoolTimer" (Indicator: "CreateThread"; in Source: "00000000-00007256-00000C1E-73832506"), Found string "CreateThreadpoolWait" (Indicator: "CreateThread"; in Source: "00000000-00007256-00000C1E-73832965"), Found string "CreateThreadpoolWork" (Indicator: "CreateThread"; in Source: "00000000-00007256-00000C1E-73835687"), Found string "CreateWaitableTimerExW" (Indicator: "CreateWaitableTimer"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "ds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125CertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before NextWSAGetOverlappedResult not found" not supported for cpu option "bufio: invalid use of UnreadBytebufio: invalid use of UnreadRunefail to seek to string table: %vfail to seek to symbol table: %vinvalid limiter event type foundnumerical argument out of domainpanic while printing panic valuereflect.nameFrom: tag too long: removespecial on invalid pointerresource temporarily unavailableruntime.semasleep wait_abandonedruntime: failed to release pagesruntime: fixalloc size too largeruntime: mcall function returnedruntime: newstack called from g=runtime: root level max pages = runtime: setevent failed; errno=runtime: stack split at bad timeruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevscanstack: goroutine not stoppedscavenger state is already wiredslice bound" (Indicator: "WSAGetOverlappedResult"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "ds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125CertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before NextWSAGetOverlappedResult not found" not supported for cpu option "bufio: invalid use of UnreadBytebufio: invalid use of UnreadRunefail to seek to string table: %vfail to seek to symbol table: %vinvalid limiter event type foundnumerical argument out of domainpanic while printing panic valuereflect.nameFrom: tag too long: removespecial on invalid pointerresource temporarily unavailableruntime.semasleep wait_abandonedruntime: failed to release pagesruntime: fixalloc size too largeruntime: mcall function returnedruntime: newstack called from g=runtime: root level max pages = runtime: setevent failed; errno=runtime: stack split at bad timeruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevscanstack: goroutine not stoppedscavenger state is already wiredslice bounds" (Indicator: "WSAGetOverlappedResult"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "DuplicateHandle" (Indicator: "DuplicateHandle"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "e East Standard TimeNew Zealand Standard TimeNorth Korea Standard TimeSouth Sudan Standard TimeTransbaikal Standard TimeUS Mountain Standard TimeUlaanbaatar Standard TimeUpdateProcThreadAttributeVladivostok Standard TimeW. Mongolia Standard Time_cgo_thread_start missingallgadd: bad status Gidlearena already initializedbad status in shrinkstackbad system huge page sizechansend: spurious wakeupcheckdead: no m for timercheckdead: no p for timerinconsistent poll.fdMutexinvalid cross-device linkmissing stack in newstackmissing traceGCSweepStartno buffer space availableno such device or addressoperation now in progressreleasep: invalid p stateremaining pointer buffersresource deadlock avoidedruntime: VirtualAlloc of runtime: program exceeds runtime" (Indicator: "VirtualAlloc"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "esGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfoIDS_Trinary_OperatorIsrael Standard TimeJordan Standard TimeMeroitic_HieroglyphsSeek: invalid offsetSeek: invalid whenceSetCurrentDirectoryWSetHandleInformationTaipei Standard TimeTerminal_PunctuationTurkey Standard Timebad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)close of nil channelconnection timed outdodeltimer0: wrong Pflate: closed writerfloating point errorforcegc: phase errorgo of nil func valuegopark: bad g statusinvalid request codeinvalid write resultis a named type filekey has been revokedmalloc during signalnotetsleep not on g0p mcache not flushedpacer: assist ratio=preempt off reason: reflect.Value.SetIntreflect.makeFuncStubruntime: double waitsemaRoot rotateRighttime: invalid numbertrace: out of memorywirep: already in goworkbuf is not emptywrite of Go pointer ws2_32.dll not foundzlib: invalid header of unexported method pcHeader.textStart= previous allocCount= levelBits[level]" (Indicator: "etCurrentDirectoryW"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "ExitProcess" (Indicator: "ExitProcess"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "FlsGetValue" (Indicator: "FlsGetValue"; in Source: "00000000-00007256-00000C1E-73813110"), Found string "FlsSetValue" (Indicator: "FlsSetValue"; in Source: "00000000-00007256-00000C1E-73777633"), Found string "FreeEnvironmentStringsW" (Indicator: "FreeEnvironmentStringsW"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; in Source: "00000000-00007256-00000C1E-73833391"), Found string "GetConsoleMode" (Indicator: "GetConsoleMode"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; in Source: "00000000-00007256-00000C1E-73833498"), Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "GetFileInformationByHandle" (Indicator: "GetFileInfo"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "GetFileInformationByHandleEx" (Indicator: "GetFileInfo"; in Source: "00000000-00007256-00000C1E-73833969"), Found string "GetFileType" (Indicator: "GetFileType"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; in Source: "00000000-00007256-00000C1E-73836177"), Found string "GetProcAddress" (Indicator: "GetProcAddress"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "GetStdHandle" (Indicator: "GetStdHandle"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "GetSystemDirectoryA" (Indicator: "GetSystemDirectoryA"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "GetSystemInfo" (Indicator: "GetSystemInfo"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; in Source: "00000000-00007256-00000C1E-73834172"), Found string "GetThreadContext" (Indicator: "GetThreadContext"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "GetTickCount64" (Indicator: "GetTickCount"; in Source: "00000000-00007256-00000C1E-73833842"), Found string "GetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "goal KiB total MB stacks [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status= cons/mark -byte limit152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollablereleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode xreary32.qyy != sweepgen MB globa" (Indicator: "GetConsoleCP"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollablereleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode xreary32.qyy != sweepgen MB global" (Indicator: "GetConsoleCP"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "h spinninggreyobject: obj not pointer-alignedmheap.freeSpanLocked - invalid freemismatched begin/end of activeSweepnetwork dropped connection on resetpersistentalloc: align is too largepidleput: P has non-empty run queueruntime: close polldesc w/o unblockruntime: createevent failed; errno=ryuFtoaFixed32 called with prec > 9traceback did not unwind completelytransport endpoint is not connected) is larger than maximum page size () is not Grunnable or Gscanrunnable0123456789abcdefghijklmnopqrstuvwxyz444089209850062616169452667236328125Go pointer stored into non-Go memoryUnable to determine system directoryaccessed data from freed user arena accessing a corrupted shared librarybytes.Reader.ReadAt: negative offsetbytes.Reader.Seek: negative positionfail to read section relocations: %vfail to read string table length: %vfailure to read data directories: %vlfstack node allocated from the heapmethod ABI and value ABI don't alignreflect: NumField of non-struct typeruntime: VirtualQuery failed; errno=runtime: bad not" (Indicator: "VirtualQuery"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "h spinninggreyobject: obj not pointer-alignedmheap.freeSpanLocked - invalid freemismatched begin/end of activeSweepnetwork dropped connection on resetpersistentalloc: align is too largepidleput: P has non-empty run queueruntime: close polldesc w/o unblockruntime: createevent failed; errno=ryuFtoaFixed32 called with prec > 9traceback did not unwind completelytransport endpoint is not connected) is larger than maximum page size () is not Grunnable or Gscanrunnable0123456789abcdefghijklmnopqrstuvwxyz444089209850062616169452667236328125Go pointer stored into non-Go memoryUnable to determine system directoryaccessed data from freed user arena accessing a corrupted shared librarybytes.Reader.ReadAt: negative offsetbytes.Reader.Seek: negative positionfail to read section relocations: %vfail to read string table length: %vfailure to read data directories: %vlfstack node allocated from the heapmethod ABI and value ABI don't alignreflect: NumField of non-struct typeruntime: VirtualQuery failed; errno=runtime: bad noti" (Indicator: "VirtualQuery"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "hIdx = runtime: work.nwait= stale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptionunexpected value step4656612873077392578125AgCebgrpgIveghnyZrzbelAleutian Standard TimeAtlantic Standard TimeCaucasus Standard TimeConvertSidToStringSidWConvertStringSidToSidWCreateEnvironmentBlockCreateIoCompletionPortDateline Standard TimeGeorgian Standard TimeGetEnvironmentStringsWGetTimeZoneInformationHawaiian Standard TimeInscriptional_ParthianMountain Standard TimeNtWaitForSingleObject" (Indicator: "ConvertSidToStringSidW"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "InitializeCriticalSectionEx" (Indicator: "InitializeCriticalSection"; in Source: "00000000-00007256-00000C1E-73760451"), Found string "ld_PersianOld_SogdianOpenProcessPau_Cin_HauRegCloseKeySetFileTimeSignWritingSoft_DottedVirtualLockWSARecvFromWarang_CitiWhite_SpaceassistQueuebad addressbad argSizebad m valuebad messagebad timedivbroken pipecgocall nilclobberfreeclosesocketcreated by crypt32.dllfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgetpeernamegetsocknameglobalAlloci/o timeoutmSpanManualmethodargs(minTrigger=mswsock.dllnetpollInitreflectOffsruntime: P runtime: g runtime: p scheddetailsecur32.dllshell32.dllshort writetracealloc(unreachableuserenv.dll B (" (Indicator: "OpenProcess"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "LoadLibraryExW" (Indicator: "LoadLibraryExW"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "LoadLibraryW" (Indicator: "LoadLibraryW"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "lock: lock countslice bounds out of rangesocket type not supportedstartm: p has runnable gsstoplockedm: not runnableunexpected fault address unexpected key value type using unaddressable value1455191522836685180664062572759576141834259033203125Bougainville Standard TimeCentral Asia Standard TimeCertFreeCertificateContextE. Australia Standard TimeEkaterinburg Standard TimeGetFileInformationByHandleLine Islands Standard TimeNewfoundland Standard TimePostQueuedCompletionStatusQueryPerformanceFrequency" (Indicator: "CertFreeCertificateContext"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "mstartbad sequence numberbad value for fieldbinary.LittleEndiandevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625AgHazncIvrjBsFrpgvbaAgJevgrIveghnyZrzbelArabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddres" (Indicator: "CreateProcessA"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "mstartbad sequence numberbad value for fieldbinary.LittleEndiandevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625AgHazncIvrjBsFrpgvbaAgJevgrIveghnyZrzbelArabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddress" (Indicator: "CreateProcessA"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "OpenThreadTokenOther_LowercaseOther_UppercaseProcess32FirstWPsalter_PahlaviRegCreateKeyExWRegDeleteValueWUnmapViewOfFile]morebuf={pc:advertise errorasyncpreemptoffdouble scavengeforce gc (idle)invalid argSizekey has expiredmalloc deadlockmisaligned maskmissing mcache?ms: gomaxprocs=network is downno medium foundno such processpreempt SPWRITErecovery failedruntime error: runtime.gopanicruntime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding psync.Mutex.Locktraceback stuck already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory" (Indicator: "OpenThread"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625AgErfhzrGuernqCertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIveghnyNyybpRkMB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriod" (Indicator: "CertCloseStore"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "rdtscpselectsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaUNKNOWNWSARecvWSASendtypes value=connectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeCyrillicDuployanEthiopicExtenderGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiParseIntPhags_PaReadFileTagbanwaTai_ThamTai_VietTifinaghUgariticWSAIoctl[signal stack=[cgocheckcs deadlockeax ebp ebx ecx edi" (Indicator: "ReadFile"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "ReleaseSRWLockExclusive" (Indicator: "ReleaseSRWLockExclusive"; in Source: "00000000-00007256-00000C1E-73835358") Found string "ResumeThread" (Indicator: "ResumeThread"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "rt of mark phasecompileCallback: float results not supportedgcmarknewobject called while doing checkmarkmult128bitPow10: power of 10 is out of rangeno P available, write barriers are forbiddennon-zero segment_selector size not supportedoptional header has unexpected Magic of 0x%xout of memory allocating heap arena metadatareflect: funcLayout with interface receiver span on userArena.faultList has invalid sizeunsafe.Slice: ptr is nil and len is not zerobufio.Scanner: Read returned impossible countcannot send after transport endpoint shutdownexitsyscall: syscall frame is no longer validoffset %d is before the start of string tableproduced a trigger greater than the heap goalreflect: internal error: invalid method indexruntime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state as before?tried to run scavenger from another goroutineunsafe.String: ptr is nil and len is not zero (bad use of unsafe.Pointer" (Indicator: "CreateWaitableTimer"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "rt of mark phasecompileCallback: float results not supportedgcmarknewobject called while doing checkmarkmult128bitPow10: power of 10 is out of rangeno P available, write barriers are forbiddennon-zero segment_selector size not supportedoptional header has unexpected Magic of 0x%xout of memory allocating heap arena metadatareflect: funcLayout with interface receiver span on userArena.faultList has invalid sizeunsafe.Slice: ptr is nil and len is not zerobufio.Scanner: Read returned impossible countcannot send after transport endpoint shutdownexitsyscall: syscall frame is no longer validoffset %d is before the start of string tableproduced a trigger greater than the heap goalreflect: internal error: invalid method indexruntime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state as before?tried to run scavenger from another goroutineunsafe.String: ptr is nil and len is not zero (bad use of unsafe.Pointer?" (Indicator: "CreateWaitableTimer"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "runtime.getGetProcAddress" (Indicator: "GetProcAddress"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "runtime.timeSleepUntil" (Indicator: "Sleep"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "runtime.traceHeapAlloc" (Indicator: "HeapAlloc"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "s <== at fp= is lr: of on pc= sp: sp=) = ) m=+Inf-Inf3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTChamDashEESTGOGCLEAFLisuMiaoModiNZDTNZSTNewaSASTThaim=] = ] n=allgallpavx2basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeadermsfilefuncidleint8itabkindpiperootsbrksse3trueuint ... MB, and got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125AdlamBamumBatakBuhidDograErrorGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicSTermTakriTamil] = (arrayclosedeferfalsefaultgcinggscanhchaninit int16int32int64mheapntohspanicscav schedsleepslicesse41sse42ssse3sudogsweeptraceuint8usage B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not 390625<-chanArabicBrahmiCarianChakmaCommonCopticFormatGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLycianLydianRejangSCHED StringSyriacTai_LeTangutTeluguThaanaUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11WanchoYezidi[]bytechan<-efencelistenobjectpopcn" (Indicator: "GetACP"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "s <== at fp= is lr: of on pc= sp: sp=) = ) m=+Inf-Inf3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTChamDashEESTGOGCLEAFLisuMiaoModiNZDTNZSTNewaSASTThaim=] = ] n=allgallpavx2basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeadermsfilefuncidleint8itabkindpiperootsbrksse3trueuint ... MB, and got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125AdlamBamumBatakBuhidDograErrorGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicSTermTakriTamil] = (arrayclosedeferfalsefaultgcinggscanhchaninit int16int32int64mheapntohspanicscav schedsleepslicesse41sse42ssse3sudogsweeptraceuint8usage B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not 390625<-chanArabicBrahmiCarianChakmaCommonCopticFormatGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLycianLydianRejangSCHED StringSyriacTai_LeTangutTeluguThaanaUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11WanchoYezidi[]bytechan<-efencelistenobjectpopcnt" (Indicator: "GetACP"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "s, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWVirtualUnlockWriteConsoleWadvapi32.dll" (Indicator: "FindNextFileW"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeUS Eastern Standard Timebad defer entry in panicbypassed recovery failedcan't scan our own stackconnection reset by peerdouble traceGCSweepStartflate: maxBits too largefunction not implementedgcDrainN phase incorrecthash of unhashable type level 2 not synchronizedlink number out of rangenot supported by windowsout of streams resourcespageAlloc: out of memoryqueuefinalizer during GCrange partially overlapsreflect.Value.SetComplexrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningupdate during transitionzlib: invalid dictionary bytes failed with errno= to unused region of span2910383045673370361328125AUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWGODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningrad Standard TimeMidd" (Indicator: "ExpandEnvironmentStringsW"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "SA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeUS Eastern Standard Timebad defer entry in panicbypassed recovery failedcan't scan our own stackconnection reset by peerdouble traceGCSweepStartflate: maxBits too largefunction not implementedgcDrainN phase incorrecthash of unhashable type level 2 not synchronizedlink number out of rangenot supported by windowsout of streams resourcespageAlloc: out of memoryqueuefinalizer during GCrange partially overlapsreflect.Value.SetComplexrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningupdate during transitionzlib: invalid dictionary bytes failed with errno= to unused region of span2910383045673370361328125AUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWGODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningrad Standard TimeMiddl" (Indicator: "ExpandEnvironmentStringsW"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetEnvironmentVariableWSingapore Standard TimeSri Lanka Standard TimeTocantins Standard TimeVenezuela Standard TimeVolgograd Standard TimeW. Europe Standard TimeWSAGetOverlappedResult" (Indicator: "SetEnvironmentVariableW"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetErrorMode" (Indicator: "SetErrorMode"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetEvent" (Indicator: "SetEvent"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetThreadContext" (Indicator: "SetThreadContext"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetUnhandledExceptionFilter" (Indicator: "SetUnhandledExceptionFilter"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetWaitableTimer" (Indicator: "SetWaitableTimer"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SleepConditionVariableCS" (Indicator: "Sleep"; in Source: "00000000-00007256-00000C1E-73834607") Found string "SleepConditionVariableSRW" (Indicator: "Sleep"; in Source: "00000000-00007256-00000C1E-73835453") Found string "SuspendThread" (Indicator: "SuspendThread"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SwitchToThread" (Indicator: "SwitchToThread"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.CloseHandle" (Indicator: "CloseHandle"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.FindClose" (Indicator: "FindClose"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.GetConsoleMode" (Indicator: "GetConsoleMode"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.GetFileType" (Indicator: "GetFileType"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.GetStdHandle" (Indicator: "GetStdHandle"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.ReadFile" (Indicator: "ReadFile"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.WSAIoctl" (Indicator: "WSAIoctl"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.WSAStartup" (Indicator: "WSAStartup"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "too many linkstoo many usersunexpected EOFunknown methodunreachable: unsafe.PointeruserArenaStatewinapi error #work.full != 0 with GC prog476837158203125: no frame (sp=ASCII_Hex_DigitCreateHardLinkWDeviceIoControlDuplicateHandleFailed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWHanifi_RohingyaImpersonateSelfLoadLibraryExA" (Indicator: "DeviceIoControl"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "TryAcquireSRWLockExclusive" (Indicator: "AcquireSRWLockExclusive"; in Source: "00000000-00007256-00000C1E-73835122") Found string "unlock: lock countsigsend: inconsistent statestack size not a power of 2stopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextFixedStack is not power-of-2GetFileInformationByHandleExPrepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredfatal: morestack on gsignalfile descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackos: process already finishedprotocol driver not attachedregion exceeds uintptr rangerunt" (Indicator: "GetFileInfo"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "unlock: lock countsigsend: inconsistent statestack size not a power of 2stopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextFixedStack is not power-of-2GetFileInformationByHandleExPrepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredfatal: morestack on gsignalfile descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackos: process already finishedprotocol driver not attachedregion exceeds uintptr rangerunti" (Indicator: "GetFileInfo"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "Variation_Selectoradaptivestackstartbad manualFreeListbufio: buffer fullconnection refusedfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errormultihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintruntime.semacreateruntime.semawakeupruntime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr stopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125AgErnqIveghnyZrzbelAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessIdGetSystemDirectoryWGetTokenInformationHaiti Standard TimeIDS_Binary_OperatorIndia Standard TimeKhitan_Small_ScriptKorea Stan" (Indicator: "CryptReleaseContext"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "Variation_Selectoradaptivestackstartbad manualFreeListbufio: buffer fullconnection refusedfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errormultihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintruntime.semacreateruntime.semawakeupruntime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr stopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125AgErnqIveghnyZrzbelAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessIdGetSystemDirectoryWGetTokenInformationHaiti Standard TimeIDS_Binary_OperatorIndia Standard TimeKhitan_Small_ScriptKorea Stand" (Indicator: "CryptReleaseContext"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "VirtualAlloc" (Indicator: "VirtualAlloc"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "VirtualFree" (Indicator: "VirtualFree"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "VirtualQuery" (Indicator: "VirtualQuery"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "WakeAllConditionVariable" (Indicator: "WakeAllConditionVariable"; in Source: "00000000-00007256-00000C1E-73834505") Found string "West Asia Standard TimeWest Bank Standard Time" missing CPU supportbytes.Buffer: too largechan receive (nil chan)close of closed channeldevice or resource busyfatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = left over markroot jobsmakechan: bad alignmentmissing type in runfinqnanotime returning zerono space left on deviceoperation not permittedoperation not supportedpanic during preemptoffprocresize: invalid argreflect.Value.Interfacereflect.Value.NumMethodreflect.methodValueCallruntime: internal errorruntime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding locksshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (work.nwait > work.nproc116415321826934814453125582076609134674072265625Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "CertFreeCertificateChain"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "workbuf is empty spinningthreads=, p.searchAddr = 0123456789ABCDEFX0123456789abcdefx1192092895507812559604644775390625: missing method DnsRecordListFreeFLE Standard TimeGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWLookupAccountSidWOld_North_ArabianOld_South_ArabianOther_ID_ContinueRegLoadMUIStringWRtlGetCurrentPeb" (Indicator: "GetCurrentProcess"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "WriteConsoleW" (Indicator: "WriteConsoleW"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "WriteFile" (Indicator: "WriteFile"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "wrong medium type but memory size because dotdotdot in async preempt to non-Go memory , locked to thread298023223876953125AgFrgPbagrkgGuernqAgTrgPbagrkgGuernqArab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWIran Standard TimeLookupAccountNameWOmsk Standard TimeRFS specific errorRegional_IndicatorRussia Time Zone 3SetFileAttributesWSystemFunction036" (Indicator: "CreateFileMappingW"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "WSAGetOverlappedResult" (Indicator: "WSAGetOverlappedResult"; in Source: "00000000-00007256-00000C1E-73889656") Found string "WSAIoctl" (Indicator: "WSAIoctl"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin")33:Tdd5,Observed string: "goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollablereleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode xreary32.qyy != sweepgen MB globa" (Indicator: "LoadLibrary") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollablereleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode xreary32.qyy != sweepgen MB global" (Indicator: "LoadLibrary") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "LoadLibraryW" (Indicator: "LoadLibrary") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "runtime.getLoadLibrary" (Indicator: "LoadLibrary") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "runtime.getLoadLibraryEx" (Indicator: "LoadLibrary") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "too many linkstoo many usersunexpected EOFunknown methodunreachable: unsafe.PointeruserArenaStatewinapi error #work.full != 0 with GC prog476837158203125: no frame (sp=ASCII_Hex_DigitCreateHardLinkWDeviceIoControlDuplicateHandleFailed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWHanifi_RohingyaImpersonateSelfLoadLibraryExA" (Indicator: "LoadLibrary") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin34:T1a25,Observed string: "edx eflags eip esi esp fs gs no anodepollDescreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.traceBuftrigger=unknown(wsaioctl (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA (MISSING)(unknown), newval=, oldval=, size = , tail = 244140625: status=Bassa_VahBhaiksukiCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyreneParseUintSamaritanSundaneseWSASendToWriteFileagqyy.qyyatomicor8bad indirchan sendcomplex64copystackctxt != 0funcargs(hchanLeafinittraceinterfaceinvalid nmSpanDeadntdll.dllpanicwaitpclmulqdqpreemptedprofBlockpsapi.dllrecover: reflect: scavtracestackpooltracebackwbufSpans} stack=[ MB goal, flushGen gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)(BADINDEX), bound" (Indicator: "WSASend") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_Lue" (Indicator: "WSAStartup") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueO" (Indicator: "WSAStartup") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "ld_PersianOld_SogdianOpenProcessPau_Cin_HauRegCloseKeySetFileTimeSignWritingSoft_DottedVirtualLockWSARecvFromWarang_CitiWhite_SpaceassistQueuebad addressbad argSizebad m valuebad messagebad timedivbroken pipecgocall nilclobberfreeclosesocketcreated by crypt32.dllfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgetpeernamegetsocknameglobalAlloci/o timeoutmSpanManualmethodargs(minTrigger=mswsock.dllnetpollInitreflectOffsruntime: P runtime: g runtime: p scheddetailsecur32.dllshell32.dllshort writetracealloc(unreachableuserenv.dll B (" (Indicator: "WSARecv") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "rdtscpselectsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaUNKNOWNWSARecvWSASendtypes value=connectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeCyrillicDuployanEthiopicExtenderGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiParseIntPhags_PaReadFileTagbanwaTai_ThamTai_VietTifinaghUgariticWSAIoctl[signal stack=[cgocheckcs deadlockeax ebp ebx ecx edi" (Indicator: "WSARecv") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "rdtscpselectsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaUNKNOWNWSARecvWSASendtypes value=connectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeCyrillicDuployanEthiopicExtenderGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiParseIntPhags_PaReadFileTagbanwaTai_ThamTai_VietTifinaghUgariticWSAIoctl[signal stack=[cgocheckcs deadlockeax ebp ebx ecx edi" (Indicator: "WSASend") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "syscall.WSARecv" (Indicator: "WSARecv") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "syscall.WSAStartup" (Indicator: "WSAStartup") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin35:T8f7,Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_Lue" (Indicator: "CreatePipe") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueO" (Indicator: "CreatePipe") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin36:Tde5,Observed string:"= 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCentral Standard TimeEastern Standard TimeGetProfilesDirectoryWInscriptional_PahlaviLookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNetUserGetLocalGroupsNorfolk Standard TimeOther_Grapheme_ExtendPacific Standard TimeReadDirectoryChangesWRomance Standard TimeRussian Standard TimeSE Asia Standard TimeSaratov Standard TimeYakutsk Standard Timeasync stack too largebad type in compare: block device requiredbufio: negative countcheckdead: runnable gconcurrent map writesdefer on system stackfindrunnable: wrong plink has been severednegative shift amountpackage not installedpanic on system stackpreempt at unknown pcread-only file systemreflect.Value.Complexreflect.Value.Pointerreflect.Value.SetUintreleasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: sear" which can Retrieves a list of local groups to which a specified user belongs. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"= 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCentral Standard TimeEastern Standard TimeGetProfilesDirectoryWInscriptional_PahlaviLookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNetUserGetLocalGroupsNorfolk Standard TimeOther_Grapheme_ExtendPacific Standard TimeReadDirectoryChangesWRomance Standard TimeRussian Standard TimeSE Asia Standard TimeSaratov Standard TimeYakutsk Standard Timeasync stack too largebad type in compare: block device requiredbufio: negative countcheckdead: runnable gconcurrent map writesdefer on system stackfindrunnable: wrong plink has been severednegative shift amountpackage not installedpanic on system stackpreempt at unknown pcread-only file systemreflect.Value.Complexreflect.Value.Pointerreflect.Value.SetUintreleasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searc" which can Retrieves a list of local groups to which a specified user belongs. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625AgErfhzrGuernqCertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIveghnyNyybpRkMB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriod" which can Retrieves information about a particular user account on a server. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]37:T653,Observed string:"profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625AgErfhzrGuernqCertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIveghnyNyybpRkMB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriod" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"s, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWVirtualUnlockWriteConsoleWadvapi32.dll" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]38:Tb8c,Observed string:"OpenThreadTokenOther_LowercaseOther_UppercaseProcess32FirstWPsalter_PahlaviRegCreateKeyExWRegDeleteValueWUnmapViewOfFile]morebuf={pc:advertise errorasyncpreemptoffdouble scavengeforce gc (idle)invalid argSizekey has expiredmalloc deadlockmisaligned maskmissing mcache?ms: gomaxprocs=network is downno medium foundno such processpreempt SPWRITErecovery failedruntime error: runtime.gopanicruntime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding psync.Mutex.Locktraceback stuck already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625AgErfhzrGuernqCertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIveghnyNyybpRkMB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriod" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"West Asia Standard TimeWest Bank Standard Time" missing CPU supportbytes.Buffer: too largechan receive (nil chan)close of closed channeldevice or resource busyfatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = left over markroot jobsmakechan: bad alignmentmissing type in runfinqnanotime returning zerono space left on deviceoperation not permittedoperation not supportedpanic during preemptoffprocresize: invalid argreflect.Value.Interfacereflect.Value.NumMethodreflect.methodValueCallruntime: internal errorruntime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding locksshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (work.nwait > work.nproc116415321826934814453125582076609134674072265625Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]39:T812,Observed string: "CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Squareruntime stack:bad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno route to hostnon-Go functionobject is remotereflect mismatchremote I/O errorruntime: addr = runtime: base = runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod" (Indicator: "RegQueryValue") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin, Observed string: "s MB) workers= called from flushedWork idlethreads= is nil not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= gp->status= not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWVirtualUnlockWriteConsoleWadvapi32.dll" (Indicator: "RegOpenKey") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "s, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWVirtualUnlockWriteConsoleWadvapi32.dll" (Indicator: "RegEnumKey") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin3a:T581,Observed string: "GetProcAddress" (Indicator: "GetProcAddress") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625AgErfhzrGuernqCertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIveghnyNyybpRkMB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriod" (Indicator: "GetProcAddress") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "runtime.getGetProcAddress" (Indicator: "GetProcAddress") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin3b:T2034,Observed string: "= 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCentral Standard TimeEastern Standard TimeGetProfilesDirectoryWInscriptional_PahlaviLookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNetUserGetLocalGroupsNorfolk Standard TimeOther_Grapheme_ExtendPacific Standard TimeReadDirectoryChangesWRomance Standard TimeRussian Standard TimeSE Asia Standard TimeSaratov Standard TimeYakutsk Standard Timeasync stack too largebad type in compare: block device requiredbufio: negative countcheckdead: runnable gconcurrent map writesdefer on system stackfindrunnable: wrong plink has been severednegative shift amountpackage not installedpanic on system stackpreempt at unknown pcread-only file systemreflect.Value.Complexreflect.Value.Pointerreflect.Value.SetUintreleasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: sear" (Indicator: "ReadDirectoryChange") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "= 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCentral Standard TimeEastern Standard TimeGetProfilesDirectoryWInscriptional_PahlaviLookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNetUserGetLocalGroupsNorfolk Standard TimeOther_Grapheme_ExtendPacific Standard TimeReadDirectoryChangesWRomance Standard TimeRussian Standard TimeSE Asia Standard TimeSaratov Standard TimeYakutsk Standard Timeasync stack too largebad type in compare: block device requiredbufio: negative countcheckdead: runnable gconcurrent map writesdefer on system stackfindrunnable: wrong plink has been severednegative shift amountpackage not installedpanic on system stackpreempt at unknown pcread-only file systemreflect.Value.Complexreflect.Value.Pointerreflect.Value.SetUintreleasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searc" (Indicator: "ReadDirectoryChange") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "esGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfoIDS_Trinary_OperatorIsrael Standard TimeJordan Standard TimeMeroitic_HieroglyphsSeek: invalid offsetSeek: invalid whenceSetCurrentDirectoryWSetHandleInformationTaipei Standard TimeTerminal_PunctuationTurkey Standard Timebad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)close of nil channelconnection timed outdodeltimer0: wrong Pflate: closed writerfloating point errorforcegc: phase errorgo of nil func valuegopark: bad g statusinvalid request codeinvalid write resultis a named type filekey has been revokedmalloc during signalnotetsleep not on g0p mcache not flushedpacer: assist ratio=preempt off reason: reflect.Value.SetIntreflect.makeFuncStubruntime: double waitsemaRoot rotateRighttime: invalid numbertrace: out of memorywirep: already in goworkbuf is not emptywrite of Go pointer ws2_32.dll not foundzlib: invalid header of unexported method pcHeader.textStart= previous allocCount=, levelBits[level]" (Indicator: "GetCurrentDirectory") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "GetSystemDirectoryA" (Indicator: "GetSystemDirectory") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollablereleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode xreary32.qyy != sweepgen MB globa" (Indicator: "GetTempPath") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollablereleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode xreary32.qyy != sweepgen MB global" (Indicator: "GetTempPath") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "Variation_Selectoradaptivestackstartbad manualFreeListbufio: buffer fullconnection refusedfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errormultihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintruntime.semacreateruntime.semawakeupruntime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr stopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125AgErnqIveghnyZrzbelAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessIdGetSystemDirectoryWGetTokenInformationHaiti Standard TimeIDS_Binary_OperatorIndia Standard TimeKhitan_Small_ScriptKorea Stan" (Indicator: "GetSystemDirectory") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "Variation_Selectoradaptivestackstartbad manualFreeListbufio: buffer fullconnection refusedfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errormultihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintruntime.semacreateruntime.semawakeupruntime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr stopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125AgErnqIveghnyZrzbelAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessIdGetSystemDirectoryWGetTokenInformationHaiti Standard TimeIDS_Binary_OperatorIndia Standard TimeKhitan_Small_ScriptKorea Stand" (Indicator: "GetSystemDirectory") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin3c:T931,Observed string:"GetSystemInfo" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"SA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeUS Eastern Standard Timebad defer entry in panicbypassed recovery failedcan't scan our own stackconnection reset by peerdouble traceGCSweepStartflate: maxBits too largefunction not implementedgcDrainN phase incorrecthash of unhashable type level 2 not synchronizedlink number out of rangenot supported by windowsout of streams resourcespageAlloc: out of memoryqueuefinalizer during GCrange partially overlapsreflect.Value.SetComplexrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningupdate during transitionzlib: invalid dictionary bytes failed with errno= to unused region of span2910383045673370361328125AUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWGODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningrad Standard TimeMidd" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin], Observed string:"SA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeUS Eastern Standard Timebad defer entry in panicbypassed recovery failedcan't scan our own stackconnection reset by peerdouble traceGCSweepStartflate: maxBits too largefunction not implementedgcDrainN phase incorrecthash of unhashable type level 2 not synchronizedlink number out of rangenot supported by windowsout of streams resourcespageAlloc: out of memoryqueuefinalizer during GCrange partially overlapsreflect.Value.SetComplexrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningupdate during transitionzlib: invalid dictionary bytes failed with errno= to unused region of span2910383045673370361328125AUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWGODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningrad Standard TimeMiddl" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]3d:T68c,Observed string:"profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625AgErfhzrGuernqCertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIveghnyNyybpRkMB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriod" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"wrong medium type but memory size because dotdotdot in async preempt to non-Go memory , locked to thread298023223876953125AgFrgPbagrkgGuernqAgTrgPbagrkgGuernqArab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWIran Standard TimeLookupAccountNameWOmsk Standard TimeRFS specific errorRegional_IndicatorRussia Time Zone 3SetFileAttributesWSystemFunction036" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]3e:T8bf,Observed string:"mstartbad sequence numberbad value for fieldbinary.LittleEndiandevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625AgHazncIvrjBsFrpgvbaAgJevgrIveghnyZrzbelArabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddres" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"mstartbad sequence numberbad value for fieldbinary.LittleEndiandevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625AgHazncIvrjBsFrpgvbaAgJevgrIveghnyZrzbelArabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddress" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]3f:T8f9,Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_Lue" (Indicator: "DeleteFileW") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueO" (Indicator: "DeleteFileW") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin40:T8c3,Observed string:"= 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCentral Standard TimeEastern Standard TimeGetProfilesDirectoryWInscriptional_PahlaviLookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNetUserGetLocalGroupsNorfolk Standard TimeOther_Grapheme_ExtendPacific Standard TimeReadDirectoryChangesWRomance Standard TimeRussian Standard TimeSE Asia Standard TimeSaratov Standard TimeYakutsk Standard Timeasync stack too largebad type in compare: block device requiredbufio: negative countcheckdead: runnable gconcurrent map writesdefer on system stackfindrunnable: wrong plink has been severednegative shift amountpackage not installedpanic on system stackpreempt at unknown pcread-only file systemreflect.Value.Complexreflect.Value.Pointerreflect.Value.SetUintreleasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: sear" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"= 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCentral Standard TimeEastern Standard TimeGetProfilesDirectoryWInscriptional_PahlaviLookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNetUserGetLocalGroupsNorfolk Standard TimeOther_Grapheme_ExtendPacific Standard TimeReadDirectoryChangesWRomance Standard TimeRussian Standard TimeSE Asia Standard TimeSaratov Standard TimeYakutsk Standard Timeasync stack too largebad type in compare: block device requiredbufio: negative countcheckdead: runnable gconcurrent map writesdefer on system stackfindrunnable: wrong plink has been severednegative shift amountpackage not installedpanic on system stackpreempt at unknown pcread-only file systemreflect.Value.Complexreflect.Value.Pointerreflect.Value.SetUintreleasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searc" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]41:T2caf,Observed string:"ard TimeLibya Standard TimeMultiByteToWideCharNepal Standard TimePattern_White_SpaceRussia Time Zone 10Russia Time Zone 11Samoa Standard TimeSetTokenInformationSudan Standard TimeSyria Standard TimeTokyo Standard TimeTomsk Standard TimeTonga Standard TimeWaitForSingleObjectYukon Standard Timeadjusttimers: bad pbad ABI descriptionbad file descriptorbad kind in runfinqbad notifyList sizebad runtime" which can Sets various types of information for a specified access token. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Squareruntime stack:bad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno route to hostnon-Go functionobject is remotereflect mismatchremote I/O errorruntime: addr = runtime: base = runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod" which can Creates a new access token that duplicates one already in existence. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin], Observed string:"CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Squareruntime stack:bad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno route to hostnon-Go functionobject is remotereflect mismatchremote I/O errorruntime: addr = runtime: base = runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod" which can Creates a new access token that duplicates an existing token. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollablereleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode xreary32.qyy != sweepgen MB globa" which can Returns the length in bytes of a valid security identifier (SID). [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollablereleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode xreary32.qyy != sweepgen MB globa" which can Terminates the impersonation of a client application. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollablereleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode xreary32.qyy != sweepgen MB global" which can Returns the length in bytes of a valid security identifier (SID). [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegcentersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollablereleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode xreary32.qyy != sweepgen MB global" which can Terminates the impersonation of a client application. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"rdtscpselectsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaUNKNOWNWSARecvWSASendtypes value=connectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeCyrillicDuployanEthiopicExtenderGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiParseIntPhags_PaReadFileTagbanwaTai_ThamTai_VietTifinaghUgariticWSAIoctl[signal stack=[cgocheckcs deadlockeax ebp ebx ecx edi" which can Copies a security identifier (SID) to a buffer. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"too many linkstoo many usersunexpected EOFunknown methodunreachable: unsafe.PointeruserArenaStatewinapi error #work.full != 0 with GC prog476837158203125: no frame (sp=ASCII_Hex_DigitCreateHardLinkWDeviceIoControlDuplicateHandleFailed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWHanifi_RohingyaImpersonateSelfLoadLibraryExA" which can Obtains an access token that impersonates the security context of the calling process. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"Variation_Selectoradaptivestackstartbad manualFreeListbufio: buffer fullconnection refusedfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errormultihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintruntime.semacreateruntime.semawakeupruntime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr stopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125AgErnqIveghnyZrzbelAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessIdGetSystemDirectoryWGetTokenInformationHaiti Standard TimeIDS_Binary_OperatorIndia Standard TimeKhitan_Small_ScriptKorea Stan" which can Retrieves a specified type of information about an access token. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string:"Variation_Selectoradaptivestackstartbad manualFreeListbufio: buffer fullconnection refusedfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errormultihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintruntime.semacreateruntime.semawakeupruntime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr stopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125AgErnqIveghnyZrzbelAltai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessIdGetSystemDirectoryWGetTokenInformationHaiti Standard TimeIDS_Binary_OperatorIndia Standard TimeKhitan_Small_ScriptKorea Stand" which can Retrieves a specified type of information about an access token. [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]42:Td25,Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_Lue" (Indicator: "ExitProcess") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "= , limit = /dev/stdin12207031256103515625: parsing Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forcedGOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == tracefree(tracegc()unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueO" (Indicator: "ExitProcess") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Squareruntime stack:bad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno route to hostnon-Go functionobject is remotereflect mismatchremote I/O errorruntime: addr = runtime: base = runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod" (Indicator: "TerminateProcess") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin, Observed string: "ExitProcess" (Indicator: "ExitProcess") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin43:T51fc,"0000008b79048b078b70088bcee8c1f7ffff8bcfffd68bf885ff74118b0f6a018b318bcee8aaf7ffff8bcfffd68b4df464890d00000000595f5e8be55dc356eb188b068bcea31cf14600e890ffffff6a0856e86af3ffff59598b351cf1460085f675de5ec3558bec6aff68dc54450064a1000000005056a10ce0460033c5508d45f464a3000000008bf156c70630674500e862010000837e1800597409ff7618e8966800005983661800c706106745008b4df464890d00000000595e8be55dc3558bec538bd9578b7d08393b743e833b007408ff33e8616800005983230085ff742a803f00568bf7740646803e0075fa2bf74656e84768000089035985c0740b565750e82814000083c40c5e5f8bc35b5dc20400558bec568bf1e846fffffff6450801740a6a2056e894f2ffff59598bc65e5dc20400558bec516a08e8e0efffff8945fc5985c074108b0d1cf1460089088b4d08894804eb0233c0a31cf146008be55dc3a118f14600c36a08b8ff544500e8f50f020033f68d4df056e8a4fdffff8b3d18f146008975fc85ff754456e8460100008bf857e8630100005959683c6745008d4f18c747103f000000e80effffff893d14f146008b078b70048bcee80ff6ffff8bcfffd6a114f14600a338f14600807d080074108b078b70048bcee8eff5ffff8bcfffd68d4df0e88dfdffff8bc7e85f0f0200c36a08b822554500e" (Indicator: "005056") "0000008b79048b078b70088bcee8c1f7ffff8bcfffd68bf885ff74118b0f6a018b318bcee8aaf7ffff8bcfffd68b4df464890d00000000595f5e8be55dc356eb188b068bcea31cf14600e890ffffff6a0856e86af3ffff59598b351cf1460085f675de5ec3558bec6aff68dc54450064a1000000005056a10ce0460033c5508d45f464a3000000008bf156c70630674500e862010000837e1800597409ff7618e8966800005983661800c706106745008b4df464890d00000000595e8be55dc3558bec538bd9578b7d08393b743e833b007408ff33e8616800005983230085ff742a803f00568bf7740646803e0075fa2bf74656e84768000089035985c0740b565750e82814000083c40c5e5f8bc35b5dc20400558bec568bf1e846fffffff6450801740a6a2056e894f2ffff59598bc65e5dc20400558bec516a08e8e0efffff8945fc5985c074108b0d1cf1460089088b4d08894804eb0233c0a31cf146008be55dc3a118f14600c36a08b8ff544500e8f50f020033f68d4df056e8a4fdffff8b3d18f146008975fc85ff754456e8460100008bf857e8630100005959683c6745008d4f18c747103f000000e80effffff893d14f146008b078b70048bcee80ff6ffff8bcfffd6a114f14600a338f14600807d080074108b078b70048bcee8eff5ffff8bcfffd68d4df0e88dfdffff8bc7e85f0f0200c36a08b822554500e8" (Indicator: "005056") "000f84db0000000fb7c650ff15b861450085c00f84c90000008b450c85c0740289308b7d1085ff0f84b00000008b4dfc8d9f2001000033c06689038d5102668b0183c102663b45f875f42bcad1f98d410150ff75fc6a5553e8bde2ffff83c41085c00f85830000006a4057680110000053e8976dffff85c074686a408d9f800000005368021000008d872001000050e8796dffff85c0744a6a5f53e8275b0000595985c0750e6a2e53e8195b0000595985c074156a40536a078d872001000050e8486dffff85c074196a0a6a108d87000100005056e85e03ffff83c41033c040eb0233c05f5e5b8be55dc333c05050505050e811aafeffcc8bff558bec81ecf4000000a10ce0460033c58945fc53568b750857e81d66ffff8bd8e81666ffff568bb84c030000e811050000598b4b648bf0f7d98d850cffffff6a781bc981e105f0ffff5081c1021000005156ff151062450085c07505210740eb338d850cffffff50ff7354e8fb1a0000595985c0751456e8fa0500005985c07409830f048977088977048b07c1e802f7d083e0018b4dfc5f5e33cd5be8303cfeff8be55dc204008bff558bec5657e88865ffff8bd033ff8b4a548d7102668b0183c102663bc775f52bce33c0d1f983f9036a010f94c068f8f44400894264ff15d86145008b4508f60004750289385f5e5dc38bff558bec535657e83c65ffff8bf033db6a025" (Indicator: "005056") "000f84db0000000fb7c650ff15b861450085c00f84c90000008b450c85c0740289308b7d1085ff0f84b00000008b4dfc8d9f2001000033c06689038d5102668b0183c102663b45f875f42bcad1f98d410150ff75fc6a5553e8bde2ffff83c41085c00f85830000006a4057680110000053e8976dffff85c074686a408d9f800000005368021000008d872001000050e8796dffff85c0744a6a5f53e8275b0000595985c0750e6a2e53e8195b0000595985c074156a40536a078d872001000050e8486dffff85c074196a0a6a108d87000100005056e85e03ffff83c41033c040eb0233c05f5e5b8be55dc333c05050505050e811aafeffcc8bff558bec81ecf4000000a10ce0460033c58945fc53568b750857e81d66ffff8bd8e81666ffff568bb84c030000e811050000598b4b648bf0f7d98d850cffffff6a781bc981e105f0ffff5081c1021000005156ff151062450085c07505210740eb338d850cffffff50ff7354e8fb1a0000595985c0751456e8fa0500005985c07409830f048977088977048b07c1e802f7d083e0018b4dfc5f5e33cd5be8303cfeff8be55dc204008bff558bec5657e88865ffff8bd033ff8b4a548d7102668b0183c102663bc775f52bce33c0d1f983f9036a010f94c068f8f44400894264ff15d86145008b4508f60004750289385f5e5dc38bff558bec535657e83c65ffff8bf033db6a025a" (Indicator: "005056") "008b4c24188b74241c0fb7c18d6e0703e883c00303c68944242885f6742c8b976801000085d27e228b87640100008b088b4008894c24348b4c24188d145003ea8954242c01542428eb058364242c006a075a8b8710020000896c244485c0740403c22be8ba00400000e85aaeffff8bd089542450e95202000085db0f85520200006a055889442414399f1002000075210fb7c1034424380344242c03c68d72fc3bc66a090f46f058894424148d4e09eb0a3bea8bf20f42f58d4e0583c1468974243c894c244c8bd18bcfe82393ffff8bd8895c244885db0f85150200008b87ec0000008bd60387f00000008944242457399f10020000756551ff74244c518bc8e8a5f1ffff8b44242483c4108b4c24248d7001881c088d140e8b4c2428e821eaffff8b44241c8d56038b74243c83ed0483ee048954241485c00f84a3000000035424248bc8e8f9e9ffff8b54241483ed0383c20383ee0389542414eb0f6a168bc8e8e0f0ffff8b54241c5959837c241c00766f8b4c24188b5424140fb7c10344241c8944243c39871002000073548b44242403c28b97500100005056ffb7100200008b1251ff74242c8bcfe8d1fcffff8b5424282be801871002000003d02bf0895424288b44245083c414398710020000750f8d8f6c010000e8615900008b542414837c242c000f869200000085f60f848a0000008b5c24248b4c24208b442" (Indicator: "005056") "008b4c24188b74241c0fb7c18d6e0703e883c00303c68944242885f6742c8b976801000085d27e228b87640100008b088b4008894c24348b4c24188d145003ea8954242c01542428eb058364242c006a075a8b8710020000896c244485c0740403c22be8ba00400000e85aaeffff8bd089542450e95202000085db0f85520200006a055889442414399f1002000075210fb7c1034424380344242c03c68d72fc3bc66a090f46f058894424148d4e09eb0a3bea8bf20f42f58d4e0583c1468974243c894c244c8bd18bcfe82393ffff8bd8895c244885db0f85150200008b87ec0000008bd60387f00000008944242457399f10020000756551ff74244c518bc8e8a5f1ffff8b44242483c4108b4c24248d7001881c088d140e8b4c2428e821eaffff8b44241c8d56038b74243c83ed0483ee048954241485c00f84a3000000035424248bc8e8f9e9ffff8b54241483ed0383c20383ee0389542414eb0f6a168bc8e8e0f0ffff8b54241c5959837c241c00766f8b4c24188b5424140fb7c10344241c8944243c39871002000073548b44242403c28b97500100005056ffb7100200008b1251ff74242c8bcfe8d1fcffff8b5424282be801871002000003d02bf0895424288b44245083c414398710020000750f8d8f6c010000e8615900008b542414837c242c000f869200000085f60f848a0000008b5c24248b4c24208b4424" (Indicator: "005056") "008bc8e8830700008907a170fa460089470433c06a205789470889470c894710894714ff35b8fa4600ff152c644500a1341d47006a2003c350ff35b8fa4600ff15306445005f5e5d5bc3558bec83e4f864a12c00000081ecdc0000008b08a1c03a4700535633db57bf403a47003b81040000007e2fbec03a470056e89d0d0300833dc03a4700ff59751a538bcfe8452e00006880554500e80b1103005956e83b0d0300598d4c2410e8120800008b450c2dbe0300000f847a0100004883e8010f8576010000803d74fa460001750e8bcfe83135000053ff15cc624500ff35c43a4700b9f81c4700e85905000050be801e47008d8c24d4000000566a20ff7514e89307000050566a126898fa46008d8c24d0000000e87e0700005056ba381d47008d8c24b8000000e8e5150000598bd08d8c249c000000e846150000598bd08d8c2480000000e8a6150000598bd08d4c2464e82b150000598bd08d4c2448e88e150000598bd08d4c242ce88215000059508d4c2414e8490600008d4c2428e8360600008d4c2440e82d0600008d4c2458e8240600008d4c2470e81b0600008d8c2488000000e80f0600008d8c24a0000000e8030600008d8c24b8000000e8f70500008d8c24d0000000e8eb050000a1c43a4700c1e0050305341d47006a2050ff35b8fa4600ff15106445008b0dc43a4700e8d7fdffff833d443a4700ff750f8bc" (Indicator: "005056") "008bc8e8830700008907a170fa460089470433c06a205789470889470c894710894714ff35b8fa4600ff152c644500a1341d47006a2003c350ff35b8fa4600ff15306445005f5e5d5bc3558bec83e4f864a12c00000081ecdc0000008b08a1c03a4700535633db57bf403a47003b81040000007e2fbec03a470056e89d0d0300833dc03a4700ff59751a538bcfe8452e00006880554500e80b1103005956e83b0d0300598d4c2410e8120800008b450c2dbe0300000f847a0100004883e8010f8576010000803d74fa460001750e8bcfe83135000053ff15cc624500ff35c43a4700b9f81c4700e85905000050be801e47008d8c24d4000000566a20ff7514e89307000050566a126898fa46008d8c24d0000000e87e0700005056ba381d47008d8c24b8000000e8e5150000598bd08d8c249c000000e846150000598bd08d8c2480000000e8a6150000598bd08d4c2464e82b150000598bd08d4c2448e88e150000598bd08d4c242ce88215000059508d4c2414e8490600008d4c2428e8360600008d4c2440e82d0600008d4c2458e8240600008d4c2470e81b0600008d8c2488000000e80f0600008d8c24a0000000e8030600008d8c24b8000000e8f70500008d8c24d0000000e8eb050000a1c43a4700c1e0050305341d47006a2050ff35b8fa4600ff15106445008b0dc43a4700e8d7fdffff833d443a4700ff750f8bcf" (Indicator: "005056") "078b838000000085c07403f0ff088b4b7c85c9741e83c8fff00fc1017515ff737ce87c5effffffb388000000e8715effff59598b45f889437c33c089bb8000000089b3880000005f5e5b8be55dc33c3b75958bf28a460188068d7601803e0075f3eb858b75fca178e146008906a17ce14600894604a180e14600894608a1a8e14600894630a1ace14600894634e961ffffff8bff558bec8b450c53568b75085733ff8d04868bc82bce83c103c1e9023bc61bdbf7d323d97410ff36e8e25dffff478d7604593bfb75f05f5e5b5dc38bff558bec83ec148b450c8365f00053568bb0b400000057568975f88945ece87f3cffff598b4d0833db6a31898160010000586a075a8945fc8955f4eb058b4d088bf76a075f83c0d033d2f7f78bfa8d04b950ff75fc8d45ec566a0150e8952100008b75fc0bd88b450883c6f98d04b883c01c5056ff75f88d45ec6a0150e8742100000bd88b45088d04b805b400000050ff75fc8d45ecff75f86a0250e8552100000bd88b45088d04b88b7df805d00000005056578d45ec6a0250e8372100000bd883c4508b45fc40836df4018945fc0f8568ffffff8b45086a385e83c0688975f88945fcc745f40c00000083c0d083c60c5056578d45ec6a0150e8f7200000ff75fc0bd88d45ecff75f8576a0150e8e32000000bd88b45fc05840000005056578d45ec6a0250e8cb2000008b75f80bd88" (Indicator: "005056") "078b838000000085c07403f0ff088b4b7c85c9741e83c8fff00fc1017515ff737ce87c5effffffb388000000e8715effff59598b45f889437c33c089bb8000000089b3880000005f5e5b8be55dc33c3b75958bf28a460188068d7601803e0075f3eb858b75fca178e146008906a17ce14600894604a180e14600894608a1a8e14600894630a1ace14600894634e961ffffff8bff558bec8b450c53568b75085733ff8d04868bc82bce83c103c1e9023bc61bdbf7d323d97410ff36e8e25dffff478d7604593bfb75f05f5e5b5dc38bff558bec83ec148b450c8365f00053568bb0b400000057568975f88945ece87f3cffff598b4d0833db6a31898160010000586a075a8945fc8955f4eb058b4d088bf76a075f83c0d033d2f7f78bfa8d04b950ff75fc8d45ec566a0150e8952100008b75fc0bd88b450883c6f98d04b883c01c5056ff75f88d45ec6a0150e8742100000bd88b45088d04b805b400000050ff75fc8d45ecff75f86a0250e8552100000bd88b45088d04b88b7df805d00000005056578d45ec6a0250e8372100000bd883c4508b45fc40836df4018945fc0f8568ffffff8b45086a385e83c0688975f88945fcc745f40c00000083c0d083c60c5056578d45ec6a0150e8f7200000ff75fc0bd88d45ecff75f8576a0150e8e32000000bd88b45fc05840000005056578d45ec6a0250e8cb2000008b75f80bd88b" (Indicator: "005056") "0f8b065353ff76048b4028034604ffd0ff7630e8238d020059395e08742b578bfb395e0c7e198b4608391cb8740bff7634ff34b8ff562c5959473b7e0c7ce7ff7608e8f48c0200595f395e047412ff7634680080000053ff7604ff562083c4105653ff15e460450050ff15a06245005b5ec3558bec83e4f881ec8c000000535657ff15fc60450050bb08224700688c4046008bcbe8f20cffff8bd0e8fd140000595984c0750833c040e99b020000b930234700e8d30cffff5033ff576800001000ff15c060450085c00f848500000050ff15c862450083ec188bcc6830924600e88e0dffff83ec18be642f46008bcc56e87e0dffffe8f686000083c4188bcc6850924600e86a0dffff83ec188bcc56e85f0dffffe8d786000083c43057575768691941005757ff15b06245008d442410be6c92460050568bcbe84d0cffff8bd0e824110000595984c00f8457ffffffe9370200008d4c2450e8620dffffb9f0214700e87d0bffff8d5424508bc8e8dd9300008d4c2438e8eb0bffffe8e390000084c0755868709246008d8c2484000000e8c92dffff50684c3f4600e81f8f020059508d4c2470e8b32dffff8bd08d4c2424e8cf1bffff59508d4c243ce8320bffff8d4c2420e81f0bffff8d4c2468e8160bffff8d8c2480000000eb5668889246008d4c2424e8742dffff50684c3f4600e8ca8e020059508d4c2470e85e2dfff" (Indicator: "005056") "0f8b065353ff76048b4028034604ffd0ff7630e8238d020059395e08742b578bfb395e0c7e198b4608391cb8740bff7634ff34b8ff562c5959473b7e0c7ce7ff7608e8f48c0200595f395e047412ff7634680080000053ff7604ff562083c4105653ff15e460450050ff15a06245005b5ec3558bec83e4f881ec8c000000535657ff15fc60450050bb08224700688c4046008bcbe8f20cffff8bd0e8fd140000595984c0750833c040e99b020000b930234700e8d30cffff5033ff576800001000ff15c060450085c00f848500000050ff15c862450083ec188bcc6830924600e88e0dffff83ec18be642f46008bcc56e87e0dffffe8f686000083c4188bcc6850924600e86a0dffff83ec188bcc56e85f0dffffe8d786000083c43057575768691941005757ff15b06245008d442410be6c92460050568bcbe84d0cffff8bd0e824110000595984c00f8457ffffffe9370200008d4c2450e8620dffffb9f0214700e87d0bffff8d5424508bc8e8dd9300008d4c2438e8eb0bffffe8e390000084c0755868709246008d8c2484000000e8c92dffff50684c3f4600e81f8f020059508d4c2470e8b32dffff8bd08d4c2424e8cf1bffff59508d4c243ce8320bffff8d4c2420e81f0bffff8d4c2468e8160bffff8d8c2480000000eb5668889246008d4c2424e8742dffff50684c3f4600e8ca8e020059508d4c2470e85e2dffff" (Indicator: "005056") "2408e8dd8cfeff50ff154063450085c0755cbe80284700ba643046008bcee8c2c8feff84c0743583ec18803d961a4700008bcc68a0964600740ce8348efeffb998284700eb0ae8288efeffb9b024470068a1000000e827b8feffeb228d4c2408e87f8cfeff8bd08bcee84e1500008d4c2408e86d8cfeff8bc8e80e0000008d4c2408e8628cfeff5e8be55dc3565783ec188bf18bcc68a4964600e8d48dfeff83ec188bcc6820304600e8c58dfeffe83d07000083c43033ff680900020057ff154062450050568b3520644500ffd66810270000ff15c0624500575757ffd65f5ec35351b9802847008adae8b18cfeff84db74065be9eafeffffc605971a4700015bc351ba64304600b980284700e8d3c7feff84c0742283ec188bcc6a0168b4964600e8708dfeff68a1000000b9b0244700e84bb7feff59c3c605971a47000159c3c605971a470000c351803d961a4700005356740432c0eb5abe982847008bcee8a8b4feff518bcee83bb5feff83ec188bcc6864304600e8f78cfeff68a40000008bcee8f9b6feff0fb615961a470033db438bce85c0530f4fd368b79341008815961a4700e846b8feffc605961a4700008ac35e5b59c3558bec83e4f883ec408d4c241053568b75088d460c50e8048dfeffff7624ff15b46245008d4c2418e8a78bfeff6aff6a048d4c24208b308d44243850e88aadfeff83ec188bcc68801" (Indicator: "005056") "2408e8dd8cfeff50ff154063450085c0755cbe80284700ba643046008bcee8c2c8feff84c0743583ec18803d961a4700008bcc68a0964600740ce8348efeffb998284700eb0ae8288efeffb9b024470068a1000000e827b8feffeb228d4c2408e87f8cfeff8bd08bcee84e1500008d4c2408e86d8cfeff8bc8e80e0000008d4c2408e8628cfeff5e8be55dc3565783ec188bf18bcc68a4964600e8d48dfeff83ec188bcc6820304600e8c58dfeffe83d07000083c43033ff680900020057ff154062450050568b3520644500ffd66810270000ff15c0624500575757ffd65f5ec35351b9802847008adae8b18cfeff84db74065be9eafeffffc605971a4700015bc351ba64304600b980284700e8d3c7feff84c0742283ec188bcc6a0168b4964600e8708dfeff68a1000000b9b0244700e84bb7feff59c3c605971a47000159c3c605971a470000c351803d961a4700005356740432c0eb5abe982847008bcee8a8b4feff518bcee83bb5feff83ec188bcc6864304600e8f78cfeff68a40000008bcee8f9b6feff0fb615961a470033db438bce85c0530f4fd368b79341008815961a4700e846b8feffc605961a4700008ac35e5b59c3558bec83e4f883ec408d4c241053568b75088d460c50e8048dfeffff7624ff15b46245008d4c2418e8a78bfeff6aff6a048d4c24208b308d44243850e88aadfeff83ec188bcc68801e" (Indicator: "005056") "45fc05b40000005056578d45ec6a0250e8b02000000bd883c4508b45fc83c00446836df4018945fc8975f8758d8b75088d8698000000506a28578d45ec6a0150e8802000000bd88d869c000000506a29578d45ec6a0150e8692000000bd88d864c010000506a28578d45ec6a0250e8522000000bd88d8650010000506a29578d45ec6a0250e83b20000083c4500bd88d86a0000000506a1f578d45ec6a0150e8212000000bd88d86a4000000506a20578d45ec6a0150e80a2000000bd88d86a8000000506803100000578d45ec6a0150e8f01f00000bd88d86ac000000506809100000578d45ec6a0050e8d61f000083c4500bd88d8654010000506a1f576a028d45ec50e8bc1f00000bd88d8658010000506a20578d45ec6a0250e8a51f00000bd88d865c010000506803100000578d45ec6a0250e88b1f000083c43c0bc3f7d81bc05f5e405b8be55dc38bff558bec568b750885f60f84d00000006a0756e82efdffff8d461c6a0750e823fdffff8d46386a0c50e818fdffff8d46686a0c50e80dfdffff8d86980000006a0250e8fffcffffffb6a0000000e8045bffffffb6a4000000e8f95affffffb6a8000000e8ee5affff8d86b40000006a0750e8d0fcffff8d86d00000006a0750e8c2fcffff83c4448d86ec0000006a0c50e8b1fcffff8d861c0100006a0c50e8a3fcffff8d864c0100006a0250e895fcffffffb65" (Indicator: "005056") "45fc05b40000005056578d45ec6a0250e8b02000000bd883c4508b45fc83c00446836df4018945fc8975f8758d8b75088d8698000000506a28578d45ec6a0150e8802000000bd88d869c000000506a29578d45ec6a0150e8692000000bd88d864c010000506a28578d45ec6a0250e8522000000bd88d8650010000506a29578d45ec6a0250e83b20000083c4500bd88d86a0000000506a1f578d45ec6a0150e8212000000bd88d86a4000000506a20578d45ec6a0150e80a2000000bd88d86a8000000506803100000578d45ec6a0150e8f01f00000bd88d86ac000000506809100000578d45ec6a0050e8d61f000083c4500bd88d8654010000506a1f576a028d45ec50e8bc1f00000bd88d8658010000506a20578d45ec6a0250e8a51f00000bd88d865c010000506803100000578d45ec6a0250e88b1f000083c43c0bc3f7d81bc05f5e405b8be55dc38bff558bec568b750885f60f84d00000006a0756e82efdffff8d461c6a0750e823fdffff8d46386a0c50e818fdffff8d46686a0c50e80dfdffff8d86980000006a0250e8fffcffffffb6a0000000e8045bffffffb6a4000000e8f95affffffb6a8000000e8ee5affff8d86b40000006a0750e8d0fcffff8d86d00000006a0750e8c2fcffff83c4448d86ec0000006a0c50e8b1fcffff8d861c0100006a0c50e8a3fcffff8d864c0100006a0250e895fcffffffb654" (Indicator: "005056") "5668dc0000008d459c8bf16a0050e89dd8010083c40c8d459c506bc6646aff0570fd460050ff15d86345008b45488b554c5e8d65785dc3558bec83ec2c576a098bd18d7ddc5933c0f3ab8d45d8c745d8280000005052ff15dc1a47008b45e48b55e82b45dc2b55e05f8be55dc3558bec83ec2c5356576a098bf18d7ddc5933c08bdaf3ab8d45d8c745d8280000005056ff15dc1a470085c074108b45dc89038b45e089430433c040eb0233c05f5e5b8be55dc3515355568b35ac634500576a4cffd66a4d8bd8ffd66a4e8bf8ffd66a4f8be8ffd68944241085db790b8bcbe810f5ffff0144241885ff790b8bcfe801f5ffff0144241c8b4c24188bd5e8190000008b5424108bf08b4c241ce80a0000005f8bd08bc65e5d5b59c35268ffff000051ff153c614500c3558beca1a41a470083ec0c538ad985c074046a02ffd08365f8008d55f88365fc000fb6cbc1e1048b8978164700e813ffffff8b450c8b4d080345fc034df85051894d0889450ce840ffffff59595b8be55dc3568b742408578bfaff36ff37e89dffffff595989075f89165ec3558bec83e4f881ecc8060000535556578bd9e8bba5feff33ffc74424484803000057689f7a4100578bf78bef5789742420ff15a01a4700578d44244c5057e9af000000578d842494030000897c241850578d442458c784249c0300004803000050ff159c1a470085c0747b8" (Indicator: "005056") "5668dc0000008d459c8bf16a0050e89dd8010083c40c8d459c506bc6646aff0570fd460050ff15d86345008b45488b554c5e8d65785dc3558bec83ec2c576a098bd18d7ddc5933c0f3ab8d45d8c745d8280000005052ff15dc1a47008b45e48b55e82b45dc2b55e05f8be55dc3558bec83ec2c5356576a098bf18d7ddc5933c08bdaf3ab8d45d8c745d8280000005056ff15dc1a470085c074108b45dc89038b45e089430433c040eb0233c05f5e5b8be55dc3515355568b35ac634500576a4cffd66a4d8bd8ffd66a4e8bf8ffd66a4f8be8ffd68944241085db790b8bcbe810f5ffff0144241885ff790b8bcfe801f5ffff0144241c8b4c24188bd5e8190000008b5424108bf08b4c241ce80a0000005f8bd08bc65e5d5b59c35268ffff000051ff153c614500c3558beca1a41a470083ec0c538ad985c074046a02ffd08365f8008d55f88365fc000fb6cbc1e1048b8978164700e813ffffff8b450c8b4d080345fc034df85051894d0889450ce840ffffff59595b8be55dc3568b742408578bfaff36ff37e89dffffff595989075f89165ec3558bec83e4f881ecc8060000535556578bd9e8bba5feff33ffc74424484803000057689f7a4100578bf78bef5789742420ff15a01a4700578d44244c5057e9af000000578d842494030000897c241850578d442458c784249c0300004803000050ff159c1a470085c0747b8b" (Indicator: "005056") "6c007506b853ffffffc38b44240483c2fc83c00450e893ffffff59c385c974478b542408c601158a82200200008841010fb7822002000050e801efffff83c40485c07406c6410203eb098a8221020000884102f6821203000001750b6a028d510359e96ceeffffc3568bf1578bfa8b869000000085c0750583c8ffeb42ff7670ff7424105756ffd0eb2c83f9fa74e983f9fb744e83f9fc740e83f9fd752ef6861203000001741bff7670ff7424105756ff96900000008bc883c41085c978cb5f5ec366838e1203000002ebac83f9fe740a83c8ff3bc80f45c1ebe4b8bdfeffffebdd66838e1203000004eb8c568bf10fb686fd0000008b8eec0000002bc87405e80b4601008d86e4000000c786f8000000050000008986ec00000066c786fc00000000005ec3568bf1578bbed40000008b8ed80000002bf985d2752283ff057f5e85ff7e198b86d000000003c157508d86c800000050e8d57f010083c40c0fb686e10000008b8ed00000002bc87405e89c4501008d86c8000000c786dc000000050000008986d000000033c0668986e00000008986d800000089bed40000005f5ec3568bf15733ff39be940000007564b8ccfeffffeb7dff76748b86f4000000ffb6f00000000386ec0000005056ff96940000008bc883c41085c9791f83f9fb745583f9fc742d83f9fd744bb8b9feffff83f9fe8d50130f45c2eb388b86f00" (Indicator: "005056") "6c007506b853ffffffc38b44240483c2fc83c00450e893ffffff59c385c974478b542408c601158a82200200008841010fb7822002000050e801efffff83c40485c07406c6410203eb098a8221020000884102f6821203000001750b6a028d510359e96ceeffffc3568bf1578bfa8b869000000085c0750583c8ffeb42ff7670ff7424105756ffd0eb2c83f9fa74e983f9fb744e83f9fc740e83f9fd752ef6861203000001741bff7670ff7424105756ff96900000008bc883c41085c978cb5f5ec366838e1203000002ebac83f9fe740a83c8ff3bc80f45c1ebe4b8bdfeffffebdd66838e1203000004eb8c568bf10fb686fd0000008b8eec0000002bc87405e80b4601008d86e4000000c786f8000000050000008986ec00000066c786fc00000000005ec3568bf1578bbed40000008b8ed80000002bf985d2752283ff057f5e85ff7e198b86d000000003c157508d86c800000050e8d57f010083c40c0fb686e10000008b8ed00000002bc87405e89c4501008d86c8000000c786dc000000050000008986d000000033c0668986e00000008986d800000089bed40000005f5ec3568bf15733ff39be940000007564b8ccfeffffeb7dff76748b86f4000000ffb6f00000000386ec0000005056ff96940000008bc883c41085c9791f83f9fb745583f9fc742d83f9fd744bb8b9feffff83f9fe8d50130f45c2eb388b86f000" (Indicator: "005056")44:T41a,Found string "CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Squareruntime stack:bad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno route to hostnon-Go functionobject is remotereflect mismatchremote I/O errorruntime: addr = runtime: base = runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod" (Indicator: "route"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "GetSystemInfo" (Indicator: "systeminfo"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin")45:Td84,Observed string: "SA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeUS Eastern Standard Timebad defer entry in panicbypassed recovery failedcan't scan our own stackconnection reset by peerdouble traceGCSweepStartflate: maxBits too largefunction not implementedgcDrainN phase incorrecthash of unhashable type level 2 not synchronizedlink number out of rangenot supported by windowsout of streams resourcespageAlloc: out of memoryqueuefinalizer during GCrange partially overlapsreflect.Value.SetComplexrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningupdate during transitionzlib: invalid dictionary bytes failed with errno= to unused region of span2910383045673370361328125AUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWGODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningrad Standard TimeMiddl" (Indicator: "VirtualFree") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin, Observed string: "e East Standard TimeNew Zealand Standard TimeNorth Korea Standard TimeSouth Sudan Standard TimeTransbaikal Standard TimeUS Mountain Standard TimeUlaanbaatar Standard TimeUpdateProcThreadAttributeVladivostok Standard TimeW. Mongolia Standard Time_cgo_thread_start missingallgadd: bad status Gidlearena already initializedbad status in shrinkstackbad system huge page sizechansend: spurious wakeupcheckdead: no m for timercheckdead: no p for timerinconsistent poll.fdMutexinvalid cross-device linkmissing stack in newstackmissing traceGCSweepStartno buffer space availableno such device or addressoperation now in progressreleasep: invalid p stateremaining pointer buffersresource deadlock avoidedruntime: VirtualAlloc of runtime: program exceeds runtime" (Indicator: "VirtualAlloc") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin, Observed string: "SA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeUS Eastern Standard Timebad defer entry in panicbypassed recovery failedcan't scan our own stackconnection reset by peerdouble traceGCSweepStartflate: maxBits too largefunction not implementedgcDrainN phase incorrecthash of unhashable type level 2 not synchronizedlink number out of rangenot supported by windowsout of streams resourcespageAlloc: out of memoryqueuefinalizer during GCrange partially overlapsreflect.Value.SetComplexrunqsteal: runq overflowruntime: VirtualFree of runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningupdate during transitionzlib: invalid dictionary bytes failed with errno= to unused region of span2910383045673370361328125AUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWGODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningrad Standard TimeMidd" (Indicator: "VirtualFree") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin46:Tfd0,Observed string: "Standard TimeAstrakhan Standard TimeCertGetCertificateChainDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeLogical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeRtlGetNtVersionNumbers" (Indicator: "GetSystemTimeAsFileTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "West Asia Standard TimeWest Bank Standard Time" missing CPU supportbytes.Buffer: too largechan receive (nil chan)close of closed channeldevice or resource busyfatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = left over markroot jobsmakechan: bad alignmentmissing type in runfinqnanotime returning zerono space left on deviceoperation not permittedoperation not supportedpanic during preemptoffprocresize: invalid argreflect.Value.Interfacereflect.Value.NumMethodreflect.methodValueCallruntime: internal errorruntime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding locksshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (work.nwait > work.nproc116415321826934814453125582076609134674072265625Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "ble byte arrayruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %ytried to sleep scavenger from another goroutineCreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfail to read symbol table: %d aux symbols unreadnot enough significant bits after mult64bitPow10runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=slice bounds out of range [:%x] with capacity %ystrconv: illegal AppendFloat/FormatFloat bitSizecasgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough significant bits after mult128bitPow10panicwrap: unexpected string after package name: reflect.Value.Slice: slice of unaddressable ar" (Indicator: "GetSystemTimeAsFileTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "ble byte arrayruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %ytried to sleep scavenger from another goroutineCreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscallfail to read symbol table: %d aux symbols unreadnot enough significant bits after mult64bitPow10runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject unexpected; result=runtime: waitforsingleobject wait_failed; errno=slice bounds out of range [:%x] with capacity %ystrconv: illegal AppendFloat/FormatFloat bitSizecasgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough significant bits after mult128bitPow10panicwrap: unexpected string after package name: reflect.Value.Slice: slice of unaddressable a" (Indicator: "GetSystemTimeAsFileTime") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin47:T4e1,".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005096) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005096) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005096) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005096) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005096) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005096) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005096) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005096) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005096) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005096) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005096) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005096)48:T82fa,Found string "WSAIoctl" (Indicator: "WSAIoctl"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "GetFileType" (Indicator: "GetFileType"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "GetFileInformationByHandle" (Indicator: "GetFileInfo"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetACP"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "ntohs"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "AcceptEx"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CopySid"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "ReadFile"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "socket"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "WSAIoctl"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "WSASend"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "FindClose"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "LocalFree"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "MoveFile"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "MoveFileW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "WriteFile"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CloseHandle"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CreateFileW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CreatePipe"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "DeleteFileW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "ExitProcess"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetFileType"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetIfEntry"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "getsockopt"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetVersion"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "LockFile"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "MoveFileExW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "NetShareAdd"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "NetShareDel"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "WSACleanup"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "WSAStartup"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "closesocket"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "getpeername"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "getsockname"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "OpenProcess"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RegCloseKey"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "SetFileTime"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetConsoleCP"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetLastError"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetLength"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetLengthSid"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetStdHandle"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetTempPathW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "LoadLibraryW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "ReadConsoleW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RevertToSelf"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "SetEndOfFile"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "TransmitFile"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "UnlockFile"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "VirtualQuery"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CertOpenStore"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "FindNextFileW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "MapViewOfFile"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "Module32Next"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "Module32NextW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RegDeleteKeyW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RegEnumKeyExW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RegEnumValueW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RegOpenKeyExW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "WriteConsoleW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "bad flushGen bad map statedouble unlockexchange fullfatal error: gethostbynamegetservbynameinvalid base kernel32.dll" (Indicator: "gethostbyname"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "bad flushGen bad map statedouble unlockexchange fullfatal error: gethostbynamegetservbynameinvalid base kernel32.dll" (Indicator: "getservbyname"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CertCloseStore"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CreateProcessW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CryptGenRandom"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "FindFirstFileW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "FormatMessageW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetConsoleMode"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetProcAddress"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "getprotobyname"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetUserName"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetUserNameEx"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "Module32First"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "Module32FirstW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "Process32NextW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RegSetValueExW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "SetFilePointer"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "DeviceIoControl"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "DuplicateHandle"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetAdaptersInfo"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetCommandLineW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetStartupInfoW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "LoadLibraryExA"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "LoadLibraryExW" (Indicator: "LoadLibraryExW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "OpenThread"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "OpenThreadToken"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "Process32First"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "Process32FirstW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RegCreateKeyExW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RegDeleteValueW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "UnmapViewOfFile"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CreateDirectoryW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "DuplicateToken"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "FlushFileBuffers"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetComputerName"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetComputerNameW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetCurrentThread"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetFullPathNameW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetLongPathNameW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "NetApiBufferFree"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RegQueryInfoKeyW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RegQueryValueExW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RemoveDirectoryW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "SetFilePointerEx"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "TerminateProcess"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "LookupAccountSidW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RtlGetCurrentPeb"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CommandLineToArgvW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CreateFileMappingW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetComputerNameEx"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetComputerNameExW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetFileAttributesW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetModuleFileNameW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "LookupAccountNameW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "SetFileAttributesW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CryptReleaseContext"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetCurrentProcessId"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetSystemDirectoryW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "MultiByteToWideChar"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CreateProcessA"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CreateProcessAsUserW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CryptAcquireContextW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetAcceptExSockaddrs"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "etCurrentDirectoryW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetCurrentDirectoryW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetFileAttributesExW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetProcessMemoryInfo"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "SetCurrentDirectory"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "SetCurrentDirectoryW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "SetHandleInformation"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetProfilesDirectoryW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "LookupPrivilegeValueW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "ConvertSidToStringSidW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "ConvertStringSidToSidW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CreateEnvironmentBlock"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetEnvironmentStringsW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetTimeZoneInformation"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "NtWaitForSingleObject"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "RtlGetNtVersionNumbers"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CertGetCertificateChain"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "DestroyEnvironmentBlock"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "FreeEnvironmentStringsW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetEnvironmentVariable"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetEnvironmentVariableW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetSystemTime"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetEnvironmentVariableWSingapore Standard TimeSri Lanka Standard TimeTocantins Standard TimeVenezuela Standard TimeVolgograd Standard TimeW. Europe Standard TimeWSAGetOverlappedResult" (Indicator: "SetEnvironmentVariable"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetEnvironmentVariableWSingapore Standard TimeSri Lanka Standard TimeTocantins Standard TimeVenezuela Standard TimeVolgograd Standard TimeW. Europe Standard TimeWSAGetOverlappedResult" (Indicator: "SetEnvironmentVariableW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetEnvironmentVariableWSingapore Standard TimeSri Lanka Standard TimeTocantins Standard TimeVenezuela Standard TimeVolgograd Standard TimeW. Europe Standard TimeWSAGetOverlappedResult" (Indicator: "WSAGetOverlappedResult"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CertFreeCertificateChain"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "GetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "ExpandEnvironmentStringsW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CertFreeCertificateContext"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetFileInfo"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "QueryPerformanceFrequency"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CertEnumCertificatesInStore"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CertAddCertificateContextToStore"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "WSAGetOverlappedResult"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") file/memory contains long string with (Indicator: "CreateWaitableTimer"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "runtime.traceHeapAlloc" (Indicator: "HeapAlloc"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "runtime.timeSleepUntil" (Indicator: "Sleep"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "runtime.getGetProcAddress" (Indicator: "GetProcAddress"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.ReadFile" (Indicator: "ReadFile"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.CloseHandle" (Indicator: "CloseHandle"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.FindClose" (Indicator: "FindClose"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.GetConsoleMode" (Indicator: "GetConsoleMode"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.GetFileType" (Indicator: "GetFileType"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.GetStdHandle" (Indicator: "GetStdHandle"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.WSAIoctl" (Indicator: "WSAIoctl"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.WSAStartup" (Indicator: "WSAStartup"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "syscall.Closesocket" (Indicator: "socket"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "WriteFile" (Indicator: "WriteFile"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "WriteConsoleW" (Indicator: "WriteConsoleW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "VirtualQuery" (Indicator: "VirtualQuery"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "VirtualFree" (Indicator: "VirtualFree"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SwitchToThread" (Indicator: "SwitchToThread"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SuspendThread" (Indicator: "SuspendThread"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetUnhandledExceptionFilter" (Indicator: "SetUnhandledExceptionFilter"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetUnhandledExceptionFilter" (Indicator: "UnhandledExceptionFilter"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetEvent" (Indicator: "SetEvent"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetErrorMode" (Indicator: "SetErrorMode"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "ResumeThread" (Indicator: "ResumeThread"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "LoadLibraryW" (Indicator: "LoadLibraryW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "SetThreadContext" (Indicator: "SetThreadContext"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "GetThreadContext" (Indicator: "GetThreadContext"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "GetSystemDirectoryA" (Indicator: "GetSystemDirectoryA"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "GetStdHandle" (Indicator: "GetStdHandle"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "GetProcessAffinityMask" (Indicator: "GetProcessAffinityMask"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "GetProcAddress" (Indicator: "GetProcAddress"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStringsW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "GetConsoleMode" (Indicator: "GetConsoleMode"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "FreeEnvironmentStringsW" (Indicator: "FreeEnvironmentStringsW"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "ExitProcess" (Indicator: "ExitProcess"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "DuplicateHandle" (Indicator: "DuplicateHandle"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "CreateWaitableTimerExW" (Indicator: "CreateWaitableTimer"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "CreateThread" (Indicator: "CreateThread"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "CreateFileA" (Indicator: "CreateFileA"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "CreateEventA" (Indicator: "CreateEventA"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "CloseHandle" (Indicator: "CloseHandle"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "AddVectoredExceptionHandler" (Indicator: "AddVectoredExceptionHandler"; File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin")49:T501,Observed string: "rdtscpselectsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaUNKNOWNWSARecvWSASendtypes value=connectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeCyrillicDuployanEthiopicExtenderGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiParseIntPhags_PaReadFileTagbanwaTai_ThamTai_VietTifinaghUgariticWSAIoctl[signal stack=[cgocheckcs deadlockeax ebp ebx ecx edi" (Indicator: "ReadFile") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "syscall.ReadFile" (Indicator: "ReadFile") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin4a:T68e,Observed string: "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625AgErfhzrGuernqCertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIveghnyNyybpRkMB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriod" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin] Observed string: "wrong medium type but memory size because dotdotdot in async preempt to non-Go memory , locked to thread298023223876953125AgFrgPbagrkgGuernqAgTrgPbagrkgGuernqArab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWIran Standard TimeLookupAccountNameWOmsk Standard TimeRFS specific errorRegional_IndicatorRussia Time Zone 3SetFileAttributesWSystemFunction036" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]4b:Tc9c,Found string "e East Standard TimeNew Zealand Standard TimeNorth Korea Standard TimeSouth Sudan Standard TimeTransbaikal Standard TimeUS Mountain Standard TimeUlaanbaatar Standard TimeUpdateProcThreadAttributeVladivostok Standard TimeW. Mongolia Standard Time_cgo_thread_start missingallgadd: bad status Gidlearena already initializedbad status in shrinkstackbad system huge page sizechansend: spurious wakeupcheckdead: no m for timercheckdead: no p for timerinconsistent poll.fdMutexinvalid cross-device linkmissing stack in newstackmissing traceGCSweepStartno buffer space availableno such device or addressoperation now in progressreleasep: invalid p stateremaining pointer buffersresource deadlock avoidedruntime: VirtualAlloc of runtime: program exceeds runtime" (Indicator: "UpdateProcThreadAttribute"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin") Found string "out of range [%x::]slice bounds out of range [:%x:]slice bounds out of range [::%x]software caused connection abortsweep increased allocation countuse of closed network connection of method on nil interface value142108547152020037174224853515625710542735760100185871124267578125GODEBUG: no value specified for "InitializeProcThreadAttributeListbytes.Reader.Seek: invalid whenceconcurrent map read and map writefindrunnable: negative nmspinningfreeing stack not in a stack spanleafCounts[maxBits][maxBits] != nmin must be a non-zero power of 2misrounded allocation in sysAllocreflect.nameFrom: name too long: reflect: Field index out of rangereflect: array index out of rangereflect: slice index out of rangeruntime: castogscanstatus oldval=runtime: failed mSpanList.insert runtime: failed to decommit pagesruntime: goroutine stack exceeds runtime: memory allocated by OS [runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of rangeskip everything and stop the walkslice bounds out of" (Indicator: "InitializeProcThreadAttributeList"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin"), Found string "out of range [%x::]slice bounds out of range [:%x:]slice bounds out of range [::%x]software caused connection abortsweep increased allocation countuse of closed network connection of method on nil interface value142108547152020037174224853515625710542735760100185871124267578125GODEBUG: no value specified for "InitializeProcThreadAttributeListbytes.Reader.Seek: invalid whenceconcurrent map read and map writefindrunnable: negative nmspinningfreeing stack not in a stack spanleafCounts[maxBits][maxBits] != nmin must be a non-zero power of 2misrounded allocation in sysAllocreflect.nameFrom: name too long: reflect: Field index out of rangereflect: array index out of rangereflect: slice index out of rangeruntime: castogscanstatus oldval=runtime: failed mSpanList.insert runtime: failed to decommit pagesruntime: goroutine stack exceeds runtime: memory allocated by OS [runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of rangeskip everything and stop the walkslice bounds out o" (Indicator: "InitializeProcThreadAttributeList"; in File: "3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin")4c:T4ff,Observed string: "edx eflags eip esi esp fs gs no anodepollDescreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.traceBuftrigger=unknown(wsaioctl (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA (MISSING)(unknown), newval=, oldval=, size = , tail = 244140625: status=Bassa_VahBhaiksukiCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyreneParseUintSamaritanSundaneseWSASendToWriteFileagqyy.qyyatomicor8bad indirchan sendcomplex64copystackctxt != 0funcargs(hchanLeafinittraceinterfaceinvalid nmSpanDeadntdll.dllpanicwaitpclmulqdqpreemptedprofBlockpsapi.dllrecover: reflect: scavtracestackpooltracebackwbufSpans} stack=[ MB goal, flushGen gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)(BADINDEX), bound" (Indicator: "WriteFile") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin Observed string: "WriteFile" (Indicator: "WriteFile") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin4d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAiIiIiIiIiIiIiIiIAAAAAPj/////////////jwAAAAD4/////////////48AAAAA+P////////////+PAAAAAPj/////////////jwAAAAEXiIiIiIiIiIiIiHEQAAAJmZmZmZmZmZmZmZmZkAAACZmZmZmZmZmZmZmZmZAAAAmZmXmZmYiJmXmZmZmQAAAJmZmHmZmJmJmJmZmZkAAACZmZiImZiZiJiHmZmZAAAAmZmYiYmYmYiYh5mZmQAAAJmZmImJmJmJmHmZmZkAAACZmZeIeZiImZiImZmZAAAAmZmZmZmZmZmZmZmZmQAAAJmZmZmZmZmZmZmZmZkAAAARiIiIiIiIiIiIiIgRAAAAD///////////////8AAAAA////////////////AAAAAP///////////////wAAAAD///////////////8AAAAA////////////////AAAAAP//////////////jwAAAAD/////////////iIgAAAAA/////////////4j4AAAAAP////////////+PcAAAAAD////////////4+AAAAAAA////////////j4AAAAAAAP//////////+PgAAAAAAACIiIiIiIiIiIeAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////+AAAH/gAAB/4AAAf+AAAH/gAAB/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAP/gAAH/4AAD/+AAB//gAA//4AAf//////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791592438271,"unified_at":"2026-10-10T00:33:58.271Z","metadata":{"hashes":{"sha256":"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472","sha1":"318f9034a63a6613ef5b57a10b13dc5cf30a54d7","md5":"643c5b59c7aa82d2b356472a7e2bfc5c","sha512":"b90d9a891e70acb29f82f49e9c197881bf671a12b8bc478ed486b63d5fb0545399e559709867a4b57934df14b3bdd50b3a0b7bb6737f5554d671bbb095ddde17","ssdeep":"24576:lDX7TWfq0acNRVAWEo6E+uSLgaHgDZXhETZjipt/flxGV7hya0eqrmBtngpyyedk:5dNH2XSTZiAVnYD1JzOR1cUabuwHH","ssdeep_chunks":["24576:lDX7TWf","24576:DX7TWfq","24576:X7TWfq0","24576:7TWfq0a","24576:TWfq0ac","24576:Wfq0acN","24576:fq0acNR","24576:q0acNRV","24576:0acNRVA","24576:acNRVAW","24576:cNRVAWE","24576:NRVAWEo","24576:RVAWEo6","24576:VAWEo6E","24576:AWEo6E+","24576:WEo6E+u","24576:Eo6E+uS","24576:o6E+uSL","24576:6E+uSLg","24576:E+uSLga","24576:+uSLgaH","24576:uSLgaHg","24576:SLgaHgD","24576:LgaHgDZ","24576:gaHgDZX","24576:aHgDZXh","24576:HgDZXhE","24576:gDZXhET","24576:DZXhETZ","24576:ZXhETZj","24576:XhETZji","24576:hETZjip","24576:ETZjipt","24576:TZjipt/","24576:Zjipt/f","24576:jipt/fl","24576:ipt/flx","24576:pt/flxG","24576:t/flxGV","24576:/flxGV7","24576:flxGV7h","24576:lxGV7hy","24576:xGV7hya","24576:GV7hya0","24576:V7hya0e","24576:7hya0eq","24576:hya0eqr","24576:ya0eqrm","24576:a0eqrmB","24576:0eqrmBt","24576:eqrmBtn","24576:qrmBtng","24576:rmBtngp","24576:mBtngpy","24576:Btngpyy","24576:tngpyye","24576:ngpyyed","24576:gpyyedk","49152:lDX7TWf","49152:DX7TWfq","49152:X7TWfq0","49152:7TWfq0a","49152:TWfq0ac","49152:Wfq0acN","49152:fq0acNR","49152:q0acNRV","49152:0acNRVA","49152:acNRVAW","49152:cNRVAWE","49152:NRVAWEo","49152:RVAWEo6","49152:VAWEo6E","49152:AWEo6E+","49152:WEo6E+u","49152:Eo6E+uS","49152:o6E+uSL","49152:6E+uSLg","49152:E+uSLga","49152:+uSLgaH","49152:uSLgaHg","49152:SLgaHgD","49152:LgaHgDZ","49152:gaHgDZX","49152:aHgDZXh","49152:HgDZXhE","49152:gDZXhET","49152:DZXhETZ","49152:ZXhETZj","49152:XhETZji","49152:hETZjip","49152:ETZjipt","49152:TZjipt/","49152:Zjipt/f","49152:jipt/fl","49152:ipt/flx","49152:pt/flxG","49152:t/flxGV","49152:/flxGV7","49152:flxGV7h","49152:lxGV7hy","49152:xGV7hya","49152:GV7hya0","49152:V7hya0e","49152:7hya0eq","49152:hya0eqr","49152:ya0eqrm","49152:a0eqrmB","49152:0eqrmBt","49152:eqrmBtn","49152:qrmBtng","49152:rmBtngp","49152:mBtngpy","49152:Btngpyy","49152:tngpyye","49152:ngpyyed","49152:gpyyedk","24576:5dNH2XS","24576:dNH2XST","24576:NH2XSTZ","24576:H2XSTZi","24576:2XSTZiA","24576:XSTZiAV","24576:STZiAVn","24576:TZiAVnY","24576:ZiAVnYD","24576:iAVnYD1","24576:AVnYD1J","24576:VnYD1Jz","24576:nYD1JzO","24576:YD1JzOR","24576:D1JzOR1","24576:1JzOR1c","24576:JzOR1cU","24576:zOR1cUa","24576:OR1cUab","24576:R1cUabu","24576:1cUabuw","24576:cUabuwH","24576:UabuwHH"],"imphash":"9cbefe68f395e67356e2a5d8d1b285c0"},"file_info":{"file_name":"TNT Original Invoice PDF.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3123200,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1679987119000,"last_seen":1679987120000,"last_multi_scan":1679987120000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","credentialharvesting","criminal","remcos"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":43},"sandbox_signatures":{"informative_count":83,"suspicious_count":9,"malicious_count":5,"total":97},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"DeepScan:Generic.Remcos.4C76E2C7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/FakeDoc.DK.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"DeepScan:Generic.Remcos.4C76E2C7 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Rescoms.B trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Remcos.vdm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Wacatac","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"DeepScan:Generic.Remcos","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Found Windows API related strings"},{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains Windows APIs"},{"type":"informative","value":"Contains reference to Windows native API (API string)"},{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function address"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"informative","value":"Contains ability to start/interact with device drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"},{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify the virtual address space of a process (API string)"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the cryptographic module DLL"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to close the handle to a registry key (API string)"},{"type":"informative","value":"Contains ability to create/open registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to read registry keys (API string)"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve local/system time as file time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Discovery","technique":"Domain Account","attack_id":"T1087.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/002","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve the name of the user associated with the current thread (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"malicious","value":"Making HTTPS connections using insecure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Observed string: \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Observed string: \"CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value \"GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Squareruntime stack:bad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno route to hostnon-Go functionobject is remotereflect mismatchremote I/O errorruntime: addr = runtime: base = runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod\" (Indicator: \"OpenProcessToken\") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify the virtual address space of a process (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed string:\"SetUnhandledExceptionFilter\" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007256)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007256)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Observed string:\"GetLocaleInfoEx\" [Source: 00000000-00007256-00000C1E-73836177]","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve local/system time as file time (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Observed string: \"hIdx = runtime: work.nwait= stale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptionunexpected value step4656612873077392578125AgCebgrpgIveghnyZrzbelAleutian Standard TimeAtlantic Standard TimeCaucasus Standard TimeConvertSidToStringSidWConvertStringSidToSidWCreateEnvironmentBlockCreateIoCompletionPortDateline Standard TimeGeorgian Standard TimeGetEnvironmentStringsWGetTimeZoneInformationHawaiian Standard TimeInscriptional_ParthianMountain Standard TimeNtWaitForSingleObject\" (Indicator: \"GetTimeZoneInformation\") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string: \"GetStartupInfo\" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\".exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007256)\n \".exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007256)\n \".exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007256)\n \".exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007256)\n \".exe\" called \"LoadLibrary\" with a parameter ws2_32.dll (UID: 00000000-00007256)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function address","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"}]},{"level":"informative","category":"General","name":"Contains ability to close the handle to a registry key (API string)","description":"Observed string: \"ld_PersianOld_SogdianOpenProcessPau_Cin_HauRegCloseKeySetFileTimeSignWritingSoft_DottedVirtualLockWSARecvFromWarang_CitiWhite_SpaceassistQueuebad addressbad argSizebad m valuebad messagebad timedivbroken pipecgocall nilclobberfreeclosesocketcreated by crypt32.dllfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgetpeernamegetsocknameglobalAlloci/o timeoutmSpanManualmethodargs(minTrigger=mswsock.dllnetpollInitreflectOffsruntime: P runtime: g runtime: p scheddetailsecur32.dllshell32.dllshort writetracealloc(unreachableuserenv.dll B (\" (Indicator: \"RegCloseKey\") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"Observed string: \"OpenThreadTokenOther_LowercaseOther_UppercaseProcess32FirstWPsalter_PahlaviRegCreateKeyExWRegDeleteValueWUnmapViewOfFile]morebuf={pc:advertise errorasyncpreemptoffdouble scavengeforce gc (idle)invalid argSizekey has expiredmalloc deadlockmisaligned maskmissing mcache?ms: gomaxprocs=network is downno medium foundno such processpreempt SPWRITErecovery failedruntime error: runtime.gopanicruntime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding psync.Mutex.Locktraceback stuck already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory\" (Indicator: \"RegCreateKey\") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"Observed API string: \"CreateThread\" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]\n Observed API string: \"CreateThread\" [Source: 00000000-00007256-00000C1E-73832506]\n Observed API string: \"CreateThread\" [Source: 00000000-00007256-00000C1E-73832965]\n Observed API string: \"CreateThread\" [Source: 00000000-00007256-00000C1E-73835687]\n Observed API string: \"GetThreadContext\" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]\n Observed API string: \"OpenThread\" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]\n Observed API string: \"ResumeThread\" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]\n Observed API string: \"SetThreadContext\" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]\n Observed API string: \"SuspendThread\" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Contains ability to start/interact with device drivers (API string)","description":"Observed string: \"too many linkstoo many usersunexpected EOFunknown methodunreachable: unsafe.PointeruserArenaStatewinapi error #work.full != 0 with GC prog476837158203125: no frame (sp=ASCII_Hex_DigitCreateHardLinkWDeviceIoControlDuplicateHandleFailed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWHanifi_RohingyaImpersonateSelfLoadLibraryExA\" (Indicator: \"DeviceIoControl\") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin","origin":"File/Memory","mitre_attack_id":"T1547.006","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Contains reference to Windows native API (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"}]},{"level":"informative","category":"General","name":"Found Windows API related strings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"pathgithub.com/abdullah2993/go-runpemodgithub.com/abdullah2993/go-runpe(devel)build-buildmode=exebuild-compiler=gcbuildCGO_ENABLED=0buildGOARCH=386buildGOOS=windowsbuildGO386=sse2\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"KERNEL32\" at base 77110000\n \".exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 76f30000\n \".exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 76f30000\n \".exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 76f30000\n \".exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 743d0000\n \".exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76f30000\n \".exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76f30000\n \".exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76f30000\n \".exe\" loaded module \"WS2_32.DLL\" at base 74ee0000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74310000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74E80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin\" has an writable section named \".data\"\n \"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin\" has an writable section named \".idata\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin\" file has an entrypoint instructions - \"jmp\t0x45c140,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tecx, dword ptr [esp + 4],sub\tesp, 0x28,mov\tdword ptr [esp + 0x1c], ebx,mov\tdword ptr [esp + 0x10], ebp,mov\tdword ptr [esp + 0x14], esi,mov\tdword ptr [esp + 0x18], edi,mov\tesi, eax,mov\tedx, dword ptr fs:[0x14],cmp\tedx, 0,jne\t0x45e42c,mov\teax, 0,jmp\t0x45e490,mov\tedx, dword ptr [edx],cmp\tedx, 0,jne\t0x45e43c,call\t0x45e530,mov\tdword ptr [esp + 0x20], edx,mov\tdword ptr [esp + 0x24], esp,mov\tebx, dword ptr [edx + 0x18],mov\tebx, dword ptr [ebx],cmp\tedx, ebx,je\t0x45e465,mov\tebp, dword ptr fs:[0x14],\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".rdata\" is \"0x191e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".rdata\" is \"0x191d38\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\"Go build ID: \"Ub6Sf-bFxFJkH1fDddF-/TLFanvizow80R6Qp1-SX/t7ojMeQoCihNPTwvkngG/lavdvaKcKn4HGQHw9pS0\"\" (Indicator: \"Go build ID: \"Ub6Sf-bFxFJkH1fDddF-/TLFanvizow80R6Qp1-SX/t7ojMeQoCihNPTwvkngG/lavdvaKcKn4HGQHw9pS0\")\" in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-74","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 379657)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\".exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \".exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1087.002","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"*runtime.name\"\n Heuristic match: \"__x86.get_pc_thunk.ax\"\n Heuristic match: \"__x86.get_pc_thunk.cx\"\n Heuristic match: \"__x86.get_pc_thunk.si\"\n Heuristic match: \"C:/Program Files/Go/src/runtime/runtime-gdb.py\"\n Heuristic match: \"D$+.NET\"\n Heuristic match: \"internal/reflectlite.name.name\"\n Pattern match: \"pathgithub.com/abdullah2993/go-runpemodgithub.com/abdullah2993/go-runpe(devel)build-buildmode=exebuild-compiler=gcbuildCGO_ENABLED=0buildGOARCH=386buildGOOS=windowsbuildGO386=sse2\"\n Heuristic match: \"reflect.(*funcType).in\"\n Heuristic match: \"reflect.flag.ro\"\n Heuristic match: \"reflect.name.name\"\n Heuristic match: \"reflect.Value.Int\"\n Heuristic match: \"runtime.(*bucket).mp\"\n Heuristic match: \"runtime.(*functype).in\"\n Heuristic match: \"runtime.(*pollDesc).info\"\n Heuristic match: \"runtime.name.name\"\n Heuristic match: \"sync.(*Once).Do\"\n Pattern match: \"eq.io/fs.PathError\"\n Pattern match: \"eq.sync/atomic.Pointer\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00007256)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Observed string:\"too many linkstoo many usersunexpected EOFunknown methodunreachable: unsafe.PointeruserArenaStatewinapi error #work.full != 0 with GC prog476837158203125: no frame (sp=ASCII_Hex_DigitCreateHardLinkWDeviceIoControlDuplicateHandleFailed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWHanifi_RohingyaImpersonateSelfLoadLibraryExA\" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"Observed string: \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-311","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Observed string:\"CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value \"GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Squareruntime stack:bad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno route to hostnon-Go functionobject is remotereflect mismatchremote I/O errorruntime: addr = runtime: base = runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod\" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed string:\"GetModuleFileName\" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed string:\"Standard TimeAstrakhan Standard TimeCertGetCertificateChainDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeLogical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeRtlGetNtVersionNumbers\" [Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Observed string: \"ld_PersianOld_SogdianOpenProcessPau_Cin_HauRegCloseKeySetFileTimeSignWritingSoft_DottedVirtualLockWSARecvFromWarang_CitiWhite_SpaceassistQueuebad addressbad argSizebad m valuebad messagebad timedivbroken pipecgocall nilclobberfreeclosesocketcreated by crypt32.dllfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgetpeernamegetsocknameglobalAlloci/o timeoutmSpanManualmethodargs(minTrigger=mswsock.dllnetpollInitreflectOffsruntime: P runtime: g runtime: p scheddetailsecur32.dllshell32.dllshort writetracealloc(unreachableuserenv.dll B (\" (Indicator: \"getsockname\") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the name of the user associated with the current thread (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Observed string: \"GetTickCount64\" (Indicator: \"GetTickCount\") in Source: 00000000-00007256-00000C1E-73833842","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry value (API string)","description":"Observed string: \"OpenThreadTokenOther_LowercaseOther_UppercaseProcess32FirstWPsalter_PahlaviRegCreateKeyExWRegDeleteValueWUnmapViewOfFile]morebuf={pc:advertise errorasyncpreemptoffdouble scavengeforce gc (idle)invalid argSizekey has expiredmalloc deadlockmisaligned maskmissing mcache?ms: gomaxprocs=network is downno medium foundno such processpreempt SPWRITErecovery failedruntime error: runtime.gopanicruntime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding psync.Mutex.Locktraceback stuck already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory\" (Indicator: \"RegDeleteValue\") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Observed string: \"CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value \"GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Squareruntime stack:bad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno route to hostnon-Go functionobject is remotereflect mismatchremote I/O errorruntime: addr = runtime: base = runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod\" (Indicator: \"NetApiBufferFree\") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"/19\n /32\n /46\n /65\n /78\n /90 with unusual entropies 7.99236401041\n 7.96033440248\n 0.855684854017\n 7.99751713143\n 7.99305192244\n 7.91661121932","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"$43","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"30/68 Antivirus vendors marked sample as malicious (44% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"HKLM\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 0)\n \".exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"$44","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetSystemInfo\n LoadLibraryW\n LoadLibraryA\n GetProcAddress\n GetThreadContext\n CreateThread\n WriteFile\n GetSystemDirectoryA\n CreateFileA\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"309f5374f0665674702a527420a4537470235274003b537410605374b05b537400b05374805b5374d0815374d00d5174\" to virtual address \"0x7429E018\" (part of module \"GDI32.DLL\")\n \".exe\" wrote bytes \"1032367780ec3a77208a377700000000\" to virtual address \"0x74893000\" (part of module \"WIN32U.DLL\")\n \".exe\" wrote bytes \"a0925603b0925603b017010080f00600c0020100b0f0060060b20600e0915603f0915603\" to virtual address \"0x73EDAC94\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"malicious","category":"Environment Awareness","name":"Found a Wine emulator related string","description":"\"Sentence_TerminalSystemFunction036Unified_IdeographWSAEnumProtocolsWbad TinySizeClassentersyscallblockexec format errorg already scannedinvalid bit size locked m0 woke upmark - bad statusmarkBits overflowno data availablenotetsleepg on g0permission deniedreflect.Value.Intreflect.Value.Lenreflect: call of runtime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spansync.RWMutex.Lockthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version\" (Indicator: \"wine_get_version\"; File: \"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin\")\n \"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","relevance":2,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"30/68 Antivirus vendors marked sample as malicious (44% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Observed string: \"ld_PersianOld_SogdianOpenProcessPau_Cin_HauRegCloseKeySetFileTimeSignWritingSoft_DottedVirtualLockWSARecvFromWarang_CitiWhite_SpaceassistQueuebad addressbad argSizebad m valuebad messagebad timedivbroken pipecgocall nilclobberfreeclosesocketcreated by crypt32.dllfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgetpeernamegetsocknameglobalAlloci/o timeoutmSpanManualmethodargs(minTrigger=mswsock.dllnetpollInitreflectOffsruntime: P runtime: g runtime: p scheddetailsecur32.dllshell32.dllshort writetracealloc(unreachableuserenv.dll B (\" (Indicator: \"SetFileTime\") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$47","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"General","name":"Contains Windows APIs","description":"$48","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-534","sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-535","sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00000000-00005096-00000C13-69535910 [PID: 5096]\n \".exe\" queried SystemProcessInformation at 00000000-00005096-00000C13-69537143 [PID: 5096]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"level":"malicious","category":"Network Related","name":"Making HTTPS connections using insecure TLS/SSL version","description":"Connection was made using TLSv1.1 [tls.handshake.version: 0x00000302]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Possibly tries to implement anti-virtualization techniques using MAC address detection"},{"detail":"Found a Wine emulator related string"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"},{"report_type":"sandbox","report_id":"6439cf7d1ae1b61371044063"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":29,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","credentialharvesting","criminal","remcos"],"sample_flags":["Simulated analysis"],"sandbox_reports":[{"id":"6439cf7d1ae1b61371044063","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Backdoor.Remcos","submit_name":"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.exe","analysis_start_time":"2023-04-14T22:11:10+00:00","indicators_count":{"informative":77,"suspicious":11,"malicious":5},"tags":["Simulated analysis"],"is_in_unified_schema":true},{"id":"6422de4286b01ca1e202b8ca","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DeepScan:Generic.Remcos","submit_name":"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.exe","analysis_start_time":"2023-03-28T12:32:02+00:00","indicators_count":{"informative":72,"suspicious":13,"malicious":4},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6422de4286b01ca1e202b8ca"}],"processes":[{"pid":7256,"ppid":0,"name":"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.exe","command_line":"","sha256":"3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472","normalized_path":"C:\\3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472.exe","uid":"00000000-00007256","icon":"$4d"}],"all_imported_dlls":["ws2_32.dll","user32.dll","msvcrt.dll","wow64cpu.dll","kernel32.dll","ucrtbase.dll","gdi32full.dll","cfgmgr32.dll","winmm.dll","cryptbase.dll","win32u.dll","rpcrt4.dll","fltLib.dll","ole32.dll","oleaut32.dll","ntdll.dll","apphelp.dll","sechost.dll","gdi32.dll","imm32.dll","advapi32.dll","msvcp_win.dll","winmmbase.dll","combase.dll","bcryptprimitives.dll","wow64.dll","wow64win.dll","KernelBase.dll","sspicli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6439cf7d1ae1b61371044063","6422de4286b01ca1e202b8ca"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious DeepScan:Generic.Remcos Sample 3696d769fc0c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3696d769fc0c…. Malware family: DeepScan:Generic.Remcos. Threat score 100/100. 8/28 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472"}],["$","meta","4",{"property":"og:title","content":"Malicious DeepScan:Generic.Remcos Sample 3696d769fc0c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3696d769fc0c…. Malware family: DeepScan:Generic.Remcos. Threat score 100/100. 8/28 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3696d769fc0cfbf1d2e53dc532c7f33ac7fbad2eb7744f8df3e188734e2c5472"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious DeepScan:Generic.Remcos Sample 3696d769fc0c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3696d769fc0c…. Malware family: DeepScan:Generic.Remcos. Threat score 100/100. 8/28 AV engines flagged this file. 5 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4e","11",{}]]