26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 51:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 414f59954838… — Score 80/100 — Hybrid Analysis","description":"Malicious verdict for sample 414f59954838…. Malware family: Win/malicious_confidence_60%. Threat score 80/100. 1/27 AV engines flagged this file. 2 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9","additionalType":"Malicious sample"},"threatScore":80,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9be,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp")28:T87b,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp")29:T99d,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "NtSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp")2a:T769,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001080.00000000.187646.5EAED000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001080.00000000.187646.5EAED000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001080.00000000.187646.5EAED000.00000002.mdmp")2b:T4fe,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found string "ARK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found string "ARK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp")2c:T7a6,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= plugi" (Indicator: "CertOpenStore"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=19073486328125" (Indicator: "CertCloseStore"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=19073486328125" (Indicator: "CryptGenRandom"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablere" (Indicator: "CertOpenSystemStoreW"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablere" (Indicator: "CryptAcquireContextW"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found api reference "ntgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=4656612873077392578125exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain" (Indicator: "CertGetCertificateChain"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found api reference "phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unav" (Indicator: "CertFreeCertificateChain"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in f" (Indicator: "CertFreeCertificateContext"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free ob" (Indicator: "CertCreateCertificateContext"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin"), Found api reference "684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin"), Found api reference "684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin"), Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp 00000000-00001080.00000001.188059.40000000.00000040.mdmp"), Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp 00000000-00001080.00000001.188059.40000000.00000040.mdmp"), Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp 00000000-00001080.00000001.188059.40000000.00000040.mdmp"), Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp 00000000-00001080.00000001.188059.40000000.00000040.mdmp"), Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp 00000000-00001080.00000001.188059.40000000.00000040.mdmp"), Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp 00000000-00001080.00000001.188059.40000000.00000040.mdmp"), Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp 00000000-00001080.00000001.188059.40000000.00000040.mdmp"), Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp 00000000-00001080.00000000.187646.489F9000.00000004.mdmp 00000000-00001080.00000001.188059.40000000.00000040.mdmp"), Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp 00000000-00001080.00000000.187646.489F9000.00000004.mdmp 00000000-00001080.00000001.188059.40000000.00000040.mdmp"), Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001080.00000000.187646.CE550000.00000004.mdmp")2f:T461,Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000000.187646.489F9000.00000004.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp")30:Td3f,Contains base64 string in header "keep" in header "GET /periotival HTTP/1.1Host: t.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "telegram" in header "GET /b8bz11 HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "keep" in header "GET /b8bz11 HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "keep" in header "GET / HTTP/1.1Host: why.nossamidia.net.brCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: why.nossamidia.net.brPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----hO3lhaQ7scw1Br1gAuHRCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "brPragma" in header "POST / HTTP/1.1Host: why.nossamidia.net.brPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----hO3lhaQ7scw1Br1gAuHRCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: why.nossamidia.net.brPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----hO3lhaQ7scw1Br1gAuHRCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Host: why.nossamidia.net.brPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----hO3lhaQ7scw1Br1gAuHRCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: why.nossamidia.net.brPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----hO3lhaQ7scw1Br1gAuHRCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "data" in header "POST / HTTP/1.1Host: why.nossamidia.net.brPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----hO3lhaQ7scw1Br1gAuHRCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Host: why.nossamidia.net.brPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----hO3lhaQ7scw1Br1gAuHRCache-Control: no-cacheContent-Length: 254"31:T47e,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match - ChaCha20 encryption algorithm32:T4a66,Found XOR loop in file "sample.bin" at offset 105274; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 545480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 571240; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 577704; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 584136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 662312; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 668680; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 675080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 681480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 687880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 694632; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 701000; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 707368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 713960; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 720424; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 726920; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 778696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 785096; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 791496; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 797864; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 804456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 810920; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 817384; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 823816; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 830216; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 836712; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 843112; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 856104; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 862504; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 869000; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 875432; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 881864; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 888328; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 920616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 933416; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 939976; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 959304; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2711793; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2743993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2744505; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2769812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2807886; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2819411; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2945428; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2972357; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2980691; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2988543; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3009491; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3106233; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3115733; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3130169; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3140025; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3140281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3140593; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3141689; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3161145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3163577; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3166351; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3175123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3186815; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3202708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3245395; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3252051; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3715009; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3903568; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1822568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1942376; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2444232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2798612; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2889605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3046405; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3100934; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3224850; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2929386; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 207670; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 406781; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 433445; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 434141; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 434782; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 969964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 978028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 986092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 994156; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1002220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1010284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1018348; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1026412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1034476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1042540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1050604; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1058668; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1066732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1074796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1082860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1090924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1098988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1107052; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1115116; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1123180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1131244; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1139308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1147372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1155436; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1163500; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1171564; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1179628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1187692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1195756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1203820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1211884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1219948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1228012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1236076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1244140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1252204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1260268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1268332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1276396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1284460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1292524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1300588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1308652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1316716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1324780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1332844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1340908; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1348972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1357036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1365100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1373164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1381228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1389292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1397356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1405420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1413484; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1421548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1429612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1437676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1445740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1453804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1461868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1469932; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1477996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1486060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1494124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1502188; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1510252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1525008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1534752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1536704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1932012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2005496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2104920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2253708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2294160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2361568; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2361944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2716507; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2734881; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2758637; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2759951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2763183; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2770849; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2779469; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2780833; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2796493; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2806835; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2811951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2816205; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2822035; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2825805; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2830811; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2835419; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2835887; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2838447; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2843209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2847009; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2852685; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2936411; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2941005; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2943565; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2950377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2952367; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2954317; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2962553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2965125; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2971195; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2981683; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2983885; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2990413; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3008731; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3011094; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3012941; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3022187; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3022669; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3023693; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3048169; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3051090; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3051353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3055023; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3068365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3074209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3084779; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3086255; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3100065; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3100379; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3103023; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3103181; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3108399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3108783; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3109935; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3123917; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3129933; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3133717; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3135777; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3140045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3141551; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3145617; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3146001; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3157837; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3163097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3165487; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3176611; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3189709; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3194761; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3206035; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3212591; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3218863; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3219631; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3236041; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3239059; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3253207; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3255841; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3274643; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3282793; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3283405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3284557; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3286349; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3293517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3295565; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3296289; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3306957; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3314411; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3630071; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3794080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3796032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3821156; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3966968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3988440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4132424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4233904; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4234852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4242552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4302536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4311800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4313648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4464796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4469188; code bytes = 803033:T42a,Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00001080.00000000.187646.40000000.00000040.mdmp, 00000000-00001080.00000001.188059.40000000.00000040.mdmp") Found reference to API "" (Indicator: "postmessage"; Source: "00000000-00001080.00000001.188059.CE550000.00000004.mdmp") Found reference to API "" (Indicator: "postmessage"; Source: "00000000-00001080.00000001.188059.F5CF0000.00000004.mdmp")34:Tc6f," HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu 30 Apr 2026 11:37:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12446 Connection: keep-alive Set-Cookie: stel_ssid=381bd587f5766dcb51_18389201197693800963; expires=Fri 01 May 2026 11:37:46 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /b8bz11 HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu 30 Apr 2026 11:37:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12350 Connection: keep-alive Set-Cookie: stel_ssid=652d597f129b4a9cf2_2533819124622239245; expires=Fri 01 May 2026 11:37:48 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: why.nossamidia.net.br Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Response ==> HTTP/1.1 200 OK Date: Thu 30 Apr 2026 11:37:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=5v5xTzJ4nKXiYH8KRay64K2RG3Iin%2BTyaWNYj%2F3fTSG0nBn82h1ASqnLdPz0EmR8mNZGo%2BlQsViB%2BzuOd5A3FPiv4oIHgXJeSzqYnmOEsw8ZmrJKjNxcJ6Rz0NbCD2Xh463DkWd%2B%2F38%3D"}]} Server: cloudflare vary: Accept-Encoding cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9f4641b1abc8f46e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B.......3b:Tca9," "------hO3lhaQ7scw1Br1gAuHRContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------hO3lhaQ7scw1Br1gAuHRContent-Disposition: form-data; name="build_id"59586f716174c72fa21d0a3eca7155ce------hO3lhaQ7scw1Br1gAuHR--" HTTP/1.1 200 OK Date: Thu 30 Apr 2026 11:37:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=zpIDUzwwW1bpBjfcC9CrKM%2F94MIPudHgbsFU9Lz8Dw%2FnUeKK8JoLa7d7IuzYtGH2tnKCtIcuEulhoNtMWtAmLxjEbrWsxnke%2Fzgz5lj6RgQ%2FZIOHdAzBeh6JcUBbSmzJASN0hkdaoOE%3D"}]} Server: cloudflare vary: Accept-Encoding cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9f4641b5c85e29a0-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B.......4e:T50b,Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies\DNTException\" (Source: "00000000-00001080.00000001.188059.CE550000.00000004.mdmp") Found string "??\c:\users\hapubws\appdata\local\microsoft\windows\inetcookies" (Source: "00000000-00001080.00000001.188059.CE550000.00000004.mdmp") Found string "INetCookies" (Source: "00000000-00001080.00000001.188059.CE550000.00000004.mdmp") Found string "\hapubws\appdata\local\microsoft\windows\inetcookies" (Source: "00000000-00001080.00000001.188059.CE550000.00000004.mdmp") Found string ":\users\hapubws\appdata\local\microsoft\windows\inetcookies" (Source: "00000000-00001080.00000001.188059.CE550000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00001080.00000001.188059.CE550000.00000004.mdmp, 00000000-00001080.00000001.188059.F5CF0000.00000004.mdmp") Found string "sers\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00001080.00000001.188059.CE550000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies\" (Source: "00000000-00001080.00000001.188059.CE550000.00000004.mdmp") Found string "icrosoft\Windows\INetCookies" (Source: "00000000-00001080.00000001.188059.F5CF0000.00000004.mdmp")4f:T8b2,"" (Indicator: "telegram.org") "" (Indicator: "telegram.org"), "" (Indicator: "telegram.org"), "" (Indicator: "telegram.org"), "" (Indicator: "telegram.org"), "" (Indicator: "telegram.org"), "" (Indicator: "telegram.org"), "" (Indicator: "telegram.org"), "" (Indicator: "telegram.org"), "" (Indicator: "telegram.org"), "" (Indicator: "telegram.org"), "" (Indicator: "telegram.org"), ".skype.com1&0" (Indicator: "skype.com"), "community-stage.skype.com1" (Indicator: "skype.com"), "" (Indicator: "telegram.org"), "" (Indicator: "telegram.org"), "/telegram.org/img/website_icon.svg?4">" (Indicator: "telegram.org") "on" sizes="180x180" href="//telegram.org/img/apple-touch" (Indicator: "telegram.org")50:Tbac," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\" \"------hO3lhaQ7scw1Br1gAuHRContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058------hO3lhaQ7scw1Br1gAuHRContent-Disposition: form-data; name=\"build_id\"59586f716174c72fa21d0a3eca7155ce------hO3lhaQ7scw1Br1gAuHR--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":63,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":4,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["suspicious"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"69f33ee46c473d18a9009bbf","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"contacted_countries":["GBR"],"submit_name":"414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin","analysis_start_time":"2026-04-30T11:37:10+00:00","indicators_count":{"informative":189,"suspicious":35,"malicious":2},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"address":"172.67.194.112","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]}],"dns_resolutions":[{"domain":"pillow.riverbridge.site","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"domain":"t.me","address":"149.154.167.99","ttl":16,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"domain":"telegram.me","address":"149.154.167.99","ttl":46,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"domain":"why.nossamidia.net.br","address":"172.67.194.112","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]}],"http_requests":[{"host":"t.me","host_ip":"149.154.167.99:443","url":"/periotival","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /periotival HTTP/1.1\nHost: t.me\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"host":"telegram.me","host_ip":"149.154.167.99:443","url":"/b8bz11","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /b8bz11 HTTP/1.1\nHost: telegram.me\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"host":"why.nossamidia.net.br","host_ip":"172.67.194.112:443","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: why.nossamidia.net.br\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}],"processes":[{"pid":1080,"ppid":0,"name":"414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin.exe","command_line":"","sha256":"414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9","normalized_path":"C:\\414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9.bin.exe","uid":"00000000-00001080","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["msasn1.dll","winnsi.dll","imagehlp.dll","fltLib.dll","bcryptprimitives.dll","iertutil.dll","rsaenh.dll","kernel32.dll","ws2_32.dll","cryptbase.dll","schannel.dll","VxSSL64.dll","rpcrt4.dll","win32u.dll","oleaut32.dll","shlwapi.dll","sspicli.dll","GdiPlus.dll","windows.storage.dll","crypt32.dll","bcrypt.dll","winhttp.dll","powrprof.dll","msvcp_win.dll","advapi32.dll","ntdll.dll","ncrypt.dll","imm32.dll","KernelBase.dll","user32.dll","SHCore.dll","ntasn1.dll","kernel.appcore.dll","OnDemandConnRouteHelper.dll","gpapi.dll","apphelp.dll","shell32.dll","mswsock.dll","msIso.dll","dnsapi.dll","dpapi.dll","wintrust.dll","winmm.dll","IPHLPAPI.DLL","FWPUCLNT.DLL","profapi.dll","nsi.dll","combase.dll","cfgmgr32.dll","mskeyprotect.dll","gdi32.dll","sechost.dll","ole32.dll","winmmbase.dll","cryptnet.dll","gdi32full.dll","cryptsp.dll","ncryptsslp.dll","ucrtbase.dll","msvcrt.dll","urlmon.dll","wininet.dll","rasadhlp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1080:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1080:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"name":"Local\\SM0:1080:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"name":"SM0:1080:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"name":"SM0:1080:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1080:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f33ee46c473d18a9009bbf"}]}]}},"report_ids":{"sandbox_job_ids":["69f33ee46c473d18a9009bbf"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample 414f59954838… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 414f59954838…. Malware family: Win/malicious_confidence_60%. Threat score 80/100. 1/27 AV engines flagged this file. 2 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample 414f59954838… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 414f59954838…. Malware family: Win/malicious_confidence_60%. Threat score 80/100. 1/27 AV engines flagged this file. 2 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/414f59954838b14608ef5b74ee8b23960daf6fd46418dc949fef7b5adebf2dc9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample 414f59954838… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 414f59954838…. Malware family: Win/malicious_confidence_60%. Threat score 80/100. 1/27 AV engines flagged this file. 2 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L51","11",{}]]