26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 4b0c97b77fa4… — Score 59/100 — Hybrid Analysis","description":"Malicious verdict for sample 4b0c97b77fa4…. Malware family: Win/malicious_confidence_90%. Threat score 59/100. 5/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798"],"about":{"@type":"SoftwareApplication","name":"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin","applicationCategory":["peexe","executable"],"identifier":"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798","additionalType":"Malicious sample"},"threatScore":59,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4bd,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp")28:T62c,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp, 00000000-00005420.00000000.203602.0146B000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp, 00000000-00005420.00000000.203602.0146B000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005420.00000000.203602.0146B000.00000002.mdmp")29:T7801,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such d" (Indicator: "CertOpenStore"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "eviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "eviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panicunexpected g status, g->atomicstatus=bad runtime" (Indicator: "CryptReleaseContext"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChangesWNetGetJoinInformat" (Indicator: "CertOpenSystemStoreW"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChangesWNetGetJoinInformat" (Indicator: "CryptAcquireContextW"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime retur" (Indicator: "CertGetCertificateChain"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "ning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace." (Indicator: "CertFreeCertificateChain"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStarthash of unhashable type: GODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative" (Indicator: "CertFreeCertificateContext"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorychannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gs" (Indicator: "CertCreateCertificateContext"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "ted between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]internal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixall" (Indicator: "CertAddCertificateContextToStore"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin"), Found api reference "ted between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]internal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixall" (Indicator: "CertVerifyCertificateChainPolicy"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such" (Indicator: "CertOpenStore"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChangesWNetGetJoinInforma" (Indicator: "CertOpenSystemStoreW"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChangesWNetGetJoinInforma" (Indicator: "CryptAcquireContextW"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime retu" (Indicator: "CertGetCertificateChain"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "ning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace" (Indicator: "CertFreeCertificateChain"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on g" (Indicator: "CertCreateCertificateContext"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin"), Found api reference "ted between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]internal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixal" (Indicator: "CertAddCertificateContextToStore"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found api reference "ted between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]internal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixal" (Indicator: "CertVerifyCertificateChainPolicy"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin"), Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00005420.00000000.203602.00C20000.00000004.mdmp"), Found api reference "runtime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp"), Found api reference " locked to thread synctest bubble runtime.semacreateruntime.semawakeupbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad indexnwait > work.nprocs gp->atomicstatus=marking free object KiB work (eager) [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp"), Found api reference "exit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp")2a:Tc62,Found XOR loop in file "sample.bin" at offset 1104055; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1270754; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1695956; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1744359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1744609; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1745001; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1745393; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1745785; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1747811; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1748075; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1750823; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1752963; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1753641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1754857; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1755347; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1760405; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1935290; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 379170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 379304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 776412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 983098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1938036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 495020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 527510; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 528753; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 529935; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 951312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 990927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1739654; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1741024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1744320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1746682; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1747076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1747506; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1749600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1750816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1751416; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1752608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1752952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1755888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1756430; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1760386; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1938716; code bytes = 80302b:T9f2,"" (Indicator: "GetDC"; Source: "00000000-00005420.00000000.203602.00C20000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005420.00000000.203602.00C20000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005420.00000000.203602.00C20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005420.00000000.203602.00C20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005420.00000000.203602.00C20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005420.00000000.203602.00C20000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005420.00000000.203602.00C20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005420.00000000.203602.00C20000.00000004.mdmp")35:T598,file/memory contains long string with (Indicator: "GetUserName"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp")36:Te7b,Found string "chacha8" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "aes"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "internal/chacha8rand.setup" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "internal/chacha8rand.block_generic" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "internal/chacha8rand.qr" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "aeshashbody" (Indicator: "aes"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "internal/chacha8rand/chacha8_generic.go" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "internal/chacha8rand/chacha8_stub.s" (Indicator: "chacha"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "runtime.useAeshash" (Indicator: "aes"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "runtime.aeskeysched" (Indicator: "aes"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found string "chacha8" (Indicator: "chacha"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") Found string "*chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") Found string "internal/chacha8rand" (Indicator: "chacha"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") Found string "???pc= Gadxaesshaavxfmakey1key2syncSYNCDATAIDLEidlebetabindboolint8uintchanfuncallgallprootitabsbrkdead is LEAFheapbase at Has of ) = <==GOGC] = pc=true+Inf-Inf: p=cas1cas2cas3cas4cas5cas6" (Indicator: "aes"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp, 00000000-00005420.00000000.203602.0146B000.00000002.mdmp")37:T657,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "Process32First"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005420.00000000.203602.00400000.00000040.mdmp") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp")38:T5bd,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "GetProcAddress"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "GetProcAddress"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp, 00000000-00005420.00000000.203602.0146B000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp, 00000000-00005420.00000000.203602.0146B000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005420.00000000.203602.0146B000.00000002.mdmp")39:T4ab,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "00000000-00005420.00000000.203602.0133B000.00000002.mdmp")3a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A9wAAAAAAAAAAAAAAAAAAD/cAAAB3AAAAAAAAAAAAAA/3AAAHeIiIiHcAAAAAAAAP9wAHd3iIiIiIiI93cAAAD/cAd3d4iIiIiIiIiIiAAA/3AHd3eIiIiIiIiIiIgAAP9wB3d3iIiIiIiIiIiIAAD/cAd3d4iIiIiIiIiIjwAA/3AHd3eIiIiIiIiIiIgAAP9wB3d3iIiIiIiIiIiIAAD/cAd3d4iIiIiIiIiIiAAA/3AHd3eIiIiIiIiIiIgAAP9wB3d3iIiIiIiIiIiIAAD/cAd3d4iIiIiIiIiIiAAA/3AHd3eIiIiIiIiIiIgAAP9wB3d3iIiIiIiIiIiIAAD/cAB3d4iIiIiIiIiIiAAA/3AAd3eIiIiIiIiIiIgAAP9wAHd3iIiIh4iIiIiIAAD/cAB3d/iIiHGIiIiIiAAA/3AAd3d4iIUReIiIiIgAAP9wAHcREREREReIiIiPAAD/cAAREREREREReIiIjwAA/3AAERERERERERF4iIgAAP9wABEREREREREREReIAAD/cAAREREREREREREREQAA/3AAEREREREREREREREAAP9wABERERERERERERERAAD/cAABEREREREREREREQAA/3AAAAABERERERERERAAAP9wAAAAAAAAAAERERAAAAD/cAAAAAAAAAAAAAAAAAAA///////x////wAP//wAAB/8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH//AAD///8D//////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":59,"unified_at_epoch_ms":1791822870019,"unified_at":"2026-10-12T16:34:30.019Z","metadata":{"hashes":{"sha256":"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798","sha1":"c9782347cdf6ab0754dd90b4b82e5d0388e64b60","md5":"6c361aa23e21c753e5ac65cd5ab516ea","sha512":"88e91d6807964ae1afa619b9c90863070b03116bdcd356ad4293a4022e723ffcdc36384174a1f1fb7f2d84d14fe5df1f21629e33c261e4d25a99685b13f7b3ec","ssdeep":"24576:W4AtLwSo+x1zrWQ/L63/t7u36hE1FfgUDdz+u9EcO4injXmB7Dh4mv12MxuyrHaB:WxWrI6adlv1huIaZHWGv1bQWN","ssdeep_chunks":["24576:W4AtLwS","24576:4AtLwSo","24576:AtLwSo+","24576:tLwSo+x","24576:LwSo+x1","24576:wSo+x1z","24576:So+x1zr","24576:o+x1zrW","24576:+x1zrWQ","24576:x1zrWQ/","24576:1zrWQ/L","24576:zrWQ/L6","24576:rWQ/L63","24576:WQ/L63/","24576:Q/L63/t","24576:/L63/t7","24576:L63/t7u","24576:63/t7u3","24576:3/t7u36","24576:/t7u36h","24576:t7u36hE","24576:7u36hE1","24576:u36hE1F","24576:36hE1Ff","24576:6hE1Ffg","24576:hE1FfgU","24576:E1FfgUD","24576:1FfgUDd","24576:FfgUDdz","24576:fgUDdz+","24576:gUDdz+u","24576:UDdz+u9","24576:Ddz+u9E","24576:dz+u9Ec","24576:z+u9EcO","24576:+u9EcO4","24576:u9EcO4i","24576:9EcO4in","24576:EcO4inj","24576:cO4injX","24576:O4injXm","24576:4injXmB","24576:injXmB7","24576:njXmB7D","24576:jXmB7Dh","24576:XmB7Dh4","24576:mB7Dh4m","24576:B7Dh4mv","24576:7Dh4mv1","24576:Dh4mv12","24576:h4mv12M","24576:4mv12Mx","24576:mv12Mxu","24576:v12Mxuy","24576:12Mxuyr","24576:2MxuyrH","24576:MxuyrHa","24576:xuyrHaB","49152:W4AtLwS","49152:4AtLwSo","49152:AtLwSo+","49152:tLwSo+x","49152:LwSo+x1","49152:wSo+x1z","49152:So+x1zr","49152:o+x1zrW","49152:+x1zrWQ","49152:x1zrWQ/","49152:1zrWQ/L","49152:zrWQ/L6","49152:rWQ/L63","49152:WQ/L63/","49152:Q/L63/t","49152:/L63/t7","49152:L63/t7u","49152:63/t7u3","49152:3/t7u36","49152:/t7u36h","49152:t7u36hE","49152:7u36hE1","49152:u36hE1F","49152:36hE1Ff","49152:6hE1Ffg","49152:hE1FfgU","49152:E1FfgUD","49152:1FfgUDd","49152:FfgUDdz","49152:fgUDdz+","49152:gUDdz+u","49152:UDdz+u9","49152:Ddz+u9E","49152:dz+u9Ec","49152:z+u9EcO","49152:+u9EcO4","49152:u9EcO4i","49152:9EcO4in","49152:EcO4inj","49152:cO4injX","49152:O4injXm","49152:4injXmB","49152:injXmB7","49152:njXmB7D","49152:jXmB7Dh","49152:XmB7Dh4","49152:mB7Dh4m","49152:B7Dh4mv","49152:7Dh4mv1","49152:Dh4mv12","49152:h4mv12M","49152:4mv12Mx","49152:mv12Mxu","49152:v12Mxuy","49152:12Mxuyr","49152:2MxuyrH","49152:MxuyrHa","49152:xuyrHaB","24576:WxWrI6a","24576:xWrI6ad","24576:WrI6adl","24576:rI6adlv","24576:I6adlv1","24576:6adlv1h","24576:adlv1hu","24576:dlv1huI","24576:lv1huIa","24576:v1huIaZ","24576:1huIaZH","24576:huIaZHW","24576:uIaZHWG","24576:IaZHWGv","24576:aZHWGv1","24576:ZHWGv1b","24576:HWGv1bQ","24576:WGv1bQW","24576:Gv1bQWN"],"imphash":"1aae8bf580c846f39c71c05898e57e88"},"file_info":{"file_name":"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1958400,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1776406222000,"last_seen":1776406230000,"last_multi_scan":1776406230000}},"detections":{"summary":{"verdict":"malicious","score":59,"tags":null},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":53},"sandbox_signatures":{"informative_count":111,"suspicious_count":9,"malicious_count":1,"total":121},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/TrojanDropper.Agent.EK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Suspicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_90%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to query volume/memory size (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005420.00000000.203602.00400000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; Source: \"00000000-00005420.00000000.203602.0133B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005420.00000000.203602.0133B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005420.00000000.203602.00C20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; File: \"4b0c97b77fa4fcca148b808dd1461ec6b0966280d34da074f494cf9b3aa7d798.bin\")\n Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; Source: \"00000000-00005420.00000000.203602.0146B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005420.00000000.203602.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005420.00000000.203602.0133B000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005420.00000000.203602.00C20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69e1ced4c57dfdabe402cb56"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"