24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4dc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Adware.Tedy.Generic Sample 4e1e49ae9357… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4e1e49ae9357…. Malware family: Adware.Tedy.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00","keywords":["Malicious","Adware.Tedy.Generic","malware analysis","sandbox report","threat intelligence","4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00"],"about":{"@type":"SoftwareApplication","name":"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Adware.Tedy.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6b3,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "FreeMemory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "WriteProcessMemory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CreateThreadRunContext" (Indicator: "CreateThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "FreeMemory"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")26:T50d,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "OpenThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "ResumeThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "OpenThread"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "ResumeThread"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")27:Ta27,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "SleepEx"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetTickCount64"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")28:T5f4,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "golang.org/x/sys/windows.LoadLibraryEx" (Indicator: "LoadLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "golang.org/x/sys/windows._LoadLibraryEx" (Indicator: "LoadLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "golang.org/x/sys/windows.LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "golang.org/x/sys/windows._LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")29:T1213,Found reference to "forHKDF" (Indicator: "HKDF"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "HMAC"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "ComputeHMACSHA256Hash" (Indicator: "HMAC"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "ComputeHMACSHA256Hash" (Indicator: "HMACSHA256"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "DeriveBytesIterations" (Indicator: "DeriveBytes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "EnsureSymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "pszTimestampAlgorithmOid" (Indicator: "Oid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "DefaultHashAlgorithmName" (Indicator: "HashAlgorithm"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to "forHKDF" (Indicator: "HKDF"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "HMAC"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")2a:T61f,Found string - elect not object objs next= jobs= goid sweep B -> % util alloc free span= prev= list= i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base SundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13uint16uint32uint64structCommonsendtordtscppopcntcmd/gonetdnsAES-NIsha256SHA-NIsha512headerAnswerconsolePATHEXTabortedCopySidWSARecvWSASendconnectsignal float32float64\\.\UNCforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil (scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: GODEBUG nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type TuesdayJanuaryOctoberMUI_StdMUI_DltinvaliduintptrFreeSidSleepExfips140avx512fruntimeos/exectls3destlssha1net/urlAES-CBCfile+netFullPathnil Poolno anodeCancelIoReadFileAcceptExWSAIoctlshutdownscavengepollDescsynctesttraceBufdeadlockraceFinipanicnilcgocheckrunnablerax rbx rcx rdx rdi rsi rbp rsp; Source: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string - m=nil base SundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13uint16uint32uint64structCommonsendtordtscppopcntcmd/gonetdnsAES-NIsha256SHA-NIsha512headerAnswerconsolePATHEXTabortedCopySidWSARecvWSASendconnectsignal float32float64\\.\UNCforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")2b:T481,Found reference to API "crypto/internal/fips140/aes.decryptBlock" (Indicator: ".decrypt"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "crypto/internal/fips140/aes.decryptBlockGeneric" (Indicator: ".decrypt"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "crypto/internal/fips140/aes.decryptBlockAsm" (Indicator: ".decrypt"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CreateDecryptor" (Indicator: "CreateDecryptor"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "crypto/internal/fips140/aes.decryptBlock" (Indicator: ".decrypt"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "crypto/internal/fips140/aes.decryptBlockGeneric" (Indicator: ".decrypt"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "crypto/internal/fips140/aes.decryptBlockAsm" (Indicator: ".decrypt"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")2c:Ta4c9,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffernot pollableCfgMgr32.dllsetupapi.dllwintrust.dllwtsapi32.dllReportEventWCreateMutexWGetCommStateGetProcessIdLoadResourceLockResourceReleaseMutexResumeThreadSetCommBreakSetCommStateSetErrorModeSetStdHandleThread32NextVirtualAllocCoCreateGuidgotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmunknown sizeRCodeSuccessRCodeRefusedFindFirstFilelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameRegDeleteKeyWRegEnumValueWdalTLDpSugct?GetTempPath2WModule32NextWRtlGetVersionwakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , no" (Indicator: "CertOpenStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "t pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=DeleteServiceStartServiceWFindResourceWGetDriveTypeWThread32FirstWaitCommEventRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodWTSFreeMemory#failfipscastcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256... omitting file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #RegSetValueExWunexpected EOFOpenSCManagerWModule32Firs" (Indicator: "CertCloseStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "t pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=DeleteServiceStartServiceWFindResourceWGetDriveTypeWThread32FirstWaitCommEventRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodWTSFreeMemory#failfipscastcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256... omitting file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #RegSetValueExWunexpected EOFOpenSCManagerWModule32Firs" (Indicator: "CryptGenRandom"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "already; errno=runtime stack:invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go functionpointerless type not in ranges:SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetFileValidDataSetPriorityClassVirtualProtectExRtlGetCurrentPebEnumChildWindowsGetDesktopWindowGetGUIThreadInfoWinVerifyTrustExGODEBUG: value "allowmultiplevcshttpcookiemaxnumRCodeFormatErrorwinreadlinkvolumeexec: killing Cmdexec: not startedpermission deniedwrong medium typeno data availableexec format errorLookupAccountSidWDnsRecordListFreeGetCurrentProcessGetShortPathNameWWSAEnumProtocolsWRegLoadMUIStringWgoroutine profileAllThreadsSyscallcontainermaxprocsGC assist markingselect (no cases)sync.RWMutex.Lockwait for GC cycletrace proc statussync.(*Cond).Wait: missing method notetsleepg on g0bad TinySizeClassimmorta" (Indicator: "CryptQueryObject"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found api reference "runtime.newosprocinternal/runtime/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != niltaggedPointerPackunknown caller pcstack: frame={sp:trace arena allocruntime: nameOff runtime: typeOff runtime: textOff GTB Standard TimeFLE Standard TimeGMT Standard TimeAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExWTSQueryUserTokenunexpected resultmultipartmaxpartsurlmaxqueryparamsGetExitCodeProcesssegmentation faultoperation canceledno child processesconnection refusedRFS specific erroridentifier removedinput/output errormultihop attemptedfile name too longno locks availablestreams pipe errorLookupAccountNameWCreateFileMappingWGetFileAttributesWSetFileAttributesWCommandLineToArgvWcontext.BackgroundGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWadaptivestackstartdontfreezetheworldtraceadvanceperiodtracebackancestorsgarbage collectionsync.RWMutex.RLockGC worker (active)stopping the worldwait until GC endssystem" (Indicator: "CertFindExtension"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found api reference "runtime.newosprocinternal/runtime/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != niltaggedPointerPackunknown caller pcstack: frame={sp:trace arena allocruntime: nameOff runtime: typeOff runtime: textOff GTB Standard TimeFLE Standard TimeGMT Standard TimeAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExWTSQueryUserTokenunexpected resultmultipartmaxpartsurlmaxqueryparamsGetExitCodeProcesssegmentation faultoperation canceledno child processesconnection refusedRFS specific erroridentifier removedinput/output errormultihop attemptedfile name too longno locks availablestreams pipe errorLookupAccountNameWCreateFileMappingWGetFileAttributesWSetFileAttributesWCommandLineToArgvWcontext.BackgroundGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWadaptivestackstartdontfreezetheworldtraceadvanceperiodtracebackancestorsgarbage collectionsync.RWMutex.RLockGC worker (active)stopping the worldwait until GC endssystem" (Indicator: "CryptDecodeObject"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found api reference "page size ( but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupuse of closed fileCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard TimeCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWx509negativeserial/Drivers/etc/hostsRCodeServerFailureWaitForSingleObjectGetFileAttributesExexec: canceling Cmdillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not e" (Indicator: "CertGetNameStringW"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "page size ( but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupuse of closed fileCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard TimeCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWx509negativeserial/Drivers/etc/hostsRCodeServerFailureWaitForSingleObjectGetFileAttributesExexec: canceling Cmdillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not e" (Indicator: "CryptUnprotectData"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "page size ( but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupuse of closed fileCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard TimeCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWx509negativeserial/Drivers/etc/hostsRCodeServerFailureWaitForSingleObjectGetFileAttributesExexec: canceling Cmdillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not e" (Indicator: "PFXImportCertStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "mptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdRegConnectRegistryWskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard Timefile already existsfile does not existfile already closedQueryServiceConfigWCreatePseudoConsoleDisconnectNamedPipeGetDiskFreeSpaceExWGetLargePageMinimumGetSystemDirectoryWResizePseudoConsoleRtlAddFunctionTableGetForegroundWindowGetFileVersionInfoWWSALookupServiceEndembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersRCodeNotImplementedinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWS" (Indicator: "CertOpenSystemStoreW"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard Timefile already existsfile does not existfile already closedQueryServiceConfigWCreatePseudoConsoleDisconnectNamedPipeGetDiskFreeSpaceExWGetLargePageMinimumGetSystemDirectoryWResizePseudoConsoleRtlAddFunctionTableGetForegroundWindowGetFileVersionInfoWWSALookupServiceEndembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersRCodeNotImplementedinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWS" (Indicator: "CryptAcquireContextW"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "etCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write resultGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valueselectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard TimeChangeServiceConfigWCheckTokenMembershipQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWCertFindChainInStoreGetWi" (Indicator: "CertFindChainInStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "ForMultipleObjectsNtSetSystemInformationRtlDeleteFunctionTableRtlGetNtVersionNumbersSetupDiEnumDriverInfoWSetupDiGetClassDevsExWWSALookupServiceBeginWsimulated CAST failureexit hook invoked exitsha3: Write after Readdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the" (Indicator: "CertGetCertificateChain"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlockSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBang" (Indicator: "CertFreeCertificateChain"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "ecurityDescriptorSetSecurityDescriptorDaclSetSecurityDescriptorSaclFindNextVolumeMountPointWFindVolumeMountPointCloseQueryInformationJobObjectNtQueryInformationProcessSetupDiCallClassInstallerSetupDiGetDevicePropertyWSetupDiGetSelectedDriverWSetupDiSetSelectedDriverWtesting simulated failureGODEBUG: can not enable "hash of unhashable type: GetFileInformationByHandleinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusSetFileInformationByHandleRtlNtStatusToDosErrorNoTeball goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrink" (Indicator: "CertFreeCertificateContext"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found api reference "ing stack in libcallruntime: pcHeader: magic= traceRegion: out of memorySouth Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard TimeGetSecurityDescriptorGroupGetSecurityDescriptorOwnerNotifyServiceStatusChangeWSetSecurityDescriptorGroupSetSecurityDescriptorOwnerCertFindCertificateInStoreFindFirstVolumeMountPointWFindNextChangeNotificationGetConsoleScreenBufferInfoGetProcessWorkingSetSizeExGetSystemWindowsDirectoryWQueryFullProcessImageNameWSetProcessWorkingSetSizeExSetupDiBuildDriverInfoListinconsistent process statuschannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found api reference "ing stack in libcallruntime: pcHeader: magic= traceRegion: out of memorySouth Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard TimeGetSecurityDescriptorGroupGetSecurityDescriptorOwnerNotifyServiceStatusChangeWSetSecurityDescriptorGroupSetSecurityDescriptorOwnerCertFindCertificateInStoreFindFirstVolumeMountPointWFindNextChangeNotificationGetConsoleScreenBufferInfoGetProcessWorkingSetSizeExGetSystemWindowsDirectoryWQueryFullProcessImageNameWSetProcessWorkingSetSizeExSetupDiBuildDriverInfoListinconsistent process statuschannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertFindCertificateInStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found api reference "cess already finishedGetFileInformationByHandleExfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: alloc too largeCanada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral Europe Standard TimeEnglish name for time z" (Indicator: "CertCreateCertificateContext"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found api reference "ceDynamicInformationSetSecurityDescriptorRMControlCertDeleteCertificateFromStoreGetProcessPreferredUILanguagesGetSystemTimePreciseAsFileTimeSetupDiCreateDeviceInfoListExWSetupDiGetDeviceInstallParamsWSetupDiSetDeviceInstallParamsWfips: invalid self-test name: reflect: Elem of invalid type GODEBUG: unknown cpu feature "fips140: verification mismatchsubtle.XORBytes: dst too shortpattern contains path separatorcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames eli" (Indicator: "CertDeleteCertificateFromStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "ded...unsafe.String: len out of rangeW. Central Africa Standard TimeCentral Brazilian Standard TimeMountain Standard Time (Mexico)CertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWcrypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointergetWeakHandle on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "ded...unsafe.String: len out of rangeW. Central Africa Standard TimeCentral Brazilian Standard TimeMountain Standard Time (Mexico)CertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWcrypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointergetWeakHandle on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertDuplicateCertificateContext"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "ded...unsafe.String: len out of rangeW. Central Africa Standard TimeCentral Brazilian Standard TimeMountain Standard Time (Mexico)CertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWcrypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointergetWeakHandle on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "tal/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangewaiting for unsupported file typecan't wait on blocking operationsCryptAcquireCertificatePrivateKeySetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWGODEBUG: no value specified for "concurrent map read and map writetable must have positive capacityNoDefaultCurrentDirectoryInExePathtoo many references: cannot spliceSetFileCompletionNotificationModesslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas... too many potential issues .../memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many" (Indicator: "CryptAcquireCertificatePrivateKey"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffernot pollableCfgMgr32.dllsetupapi.dllwintrust.dllwtsapi32.dllReportEventWCreateMutexWGetCommStateGetProcessIdLoadResourceLockResourceReleaseMutexResumeThreadSetCommBreakSetCommStateSetErrorModeSetStdHandleThread32NextVirtualAllocCoCreateGuidgotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmunknown sizeRCodeSuccessRCodeRefusedFindFirstFilelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameRegDeleteKeyWRegEnumValueWdalTLDpSugct?GetTempPath2WModule32NextWRtlGetVersionwakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: n" (Indicator: "CertOpenStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found api reference "t pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=DeleteServiceStartServiceWFindResourceWGetDriveTypeWThread32FirstWaitCommEventRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodWTSFreeMemory#failfipscastcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256... omitting file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #RegSetValueExWunexpected EOFOpenSCManagerWModule32Fir" (Indicator: "CertCloseStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "t pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=DeleteServiceStartServiceWFindResourceWGetDriveTypeWThread32FirstWaitCommEventRtlInitStringCoTaskMemFreeEnumProcessesShellExecuteWExitWindowsExGetClassNameWtimeEndPeriodWTSFreeMemory#failfipscastcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256... omitting file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #RegSetValueExWunexpected EOFOpenSCManagerWModule32Fir" (Indicator: "CryptGenRandom"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "already; errno=runtime stack:invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go functionpointerless type not in ranges:SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetFileValidDataSetPriorityClassVirtualProtectExRtlGetCurrentPebEnumChildWindowsGetDesktopWindowGetGUIThreadInfoWinVerifyTrustExGODEBUG: value "allowmultiplevcshttpcookiemaxnumRCodeFormatErrorwinreadlinkvolumeexec: killing Cmdexec: not startedpermission deniedwrong medium typeno data availableexec format errorLookupAccountSidWDnsRecordListFreeGetCurrentProcessGetShortPathNameWWSAEnumProtocolsWRegLoadMUIStringWgoroutine profileAllThreadsSyscallcontainermaxprocsGC assist markingselect (no cases)sync.RWMutex.Lockwait for GC cycletrace proc statussync.(*Cond).Wait: missing method notetsleepg on g0bad TinySizeClassimmort" (Indicator: "CryptQueryObject"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found api reference "page size ( but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupuse of closed fileCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard TimeCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWx509negativeserial/Drivers/etc/hostsRCodeServerFailureWaitForSingleObjectGetFileAttributesExexec: canceling Cmdillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not" (Indicator: "CertGetNameStringW"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "page size ( but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupuse of closed fileCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard TimeCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWx509negativeserial/Drivers/etc/hostsRCodeServerFailureWaitForSingleObjectGetFileAttributesExexec: canceling Cmdillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not" (Indicator: "CryptUnprotectData"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "page size ( but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupuse of closed fileCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard TimeCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectoryTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameWx509negativeserial/Drivers/etc/hostsRCodeServerFailureWaitForSingleObjectGetFileAttributesExexec: canceling Cmdillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not" (Indicator: "PFXImportCertStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard Timefile already existsfile does not existfile already closedQueryServiceConfigWCreatePseudoConsoleDisconnectNamedPipeGetDiskFreeSpaceExWGetLargePageMinimumGetSystemDirectoryWResizePseudoConsoleRtlAddFunctionTableGetForegroundWindowGetFileVersionInfoWWSALookupServiceEndembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersRCodeNotImplementedinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExW" (Indicator: "CertOpenSystemStoreW"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard Timefile already existsfile does not existfile already closedQueryServiceConfigWCreatePseudoConsoleDisconnectNamedPipeGetDiskFreeSpaceExWGetLargePageMinimumGetSystemDirectoryWResizePseudoConsoleRtlAddFunctionTableGetForegroundWindowGetFileVersionInfoWWSALookupServiceEndembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersRCodeNotImplementedinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExW" (Indicator: "CryptAcquireContextW"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "etCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write resultGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valueselectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard TimeChangeServiceConfigWCheckTokenMembershipQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWCertFindChainInStoreGetW" (Indicator: "CertFindChainInStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "ForMultipleObjectsNtSetSystemInformationRtlDeleteFunctionTableRtlGetNtVersionNumbersSetupDiEnumDriverInfoWSetupDiGetClassDevsExWWSALookupServiceBeginWsimulated CAST failureexit hook invoked exitsha3: Write after Readdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0th" (Indicator: "CertGetCertificateChain"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlockSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBan" (Indicator: "CertFreeCertificateChain"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found api reference "ecurityDescriptorSetSecurityDescriptorDaclSetSecurityDescriptorSaclFindNextVolumeMountPointWFindVolumeMountPointCloseQueryInformationJobObjectNtQueryInformationProcessSetupDiCallClassInstallerSetupDiGetDevicePropertyWSetupDiGetSelectedDriverWSetupDiSetSelectedDriverWtesting simulated failureGODEBUG: can not enable "hash of unhashable type: GetFileInformationByHandleinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusSetFileInformationByHandleRtlNtStatusToDosErrorNoTeball goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrin" (Indicator: "CertFreeCertificateContext"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin")2d:T7c7,file/memory contains long string with (Indicator: "CertCloseStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CryptProtectData"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CryptDecodeObject"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CertGetNameString"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CryptUnprotectData"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CryptReleaseContext"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CertOpenSystemStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CryptAcquireContext"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CertFreeCertificateContext"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CertEnumCertificatesInStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CertFindCertificateInStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CertDeleteCertificateFromStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin")2e:T1173,Observed string: "crypto/rand" (Indicator: "crypto/rand") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/fips140/aes" (Indicator: "crypto/internal/fips140/aes") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/fips140/sha512" (Indicator: "crypto/internal/fips140/sha512") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/sysrand.fatal" (Indicator: "crypto/internal/sysrand.fatal") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/fips140deps/cpu.init" (Indicator: "crypto/internal/fips140deps/cpu.init") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/impl.Register" (Indicator: "crypto/internal/impl.Register") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "type:.eq.crypto/internal/impl.implementation" (Indicator: "type:.eq.crypto/internal/impl.implementation") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "type:.eq.crypto/internal/fips140/sha256.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha256.Digest") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "type:.eq.crypto/internal/fips140/sha3.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha3.Digest") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/sysrand.warnBlocked" (Indicator: "crypto/internal/sysrand.warnBlocked") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/sysrand.Read" (Indicator: "crypto/internal/sysrand.Read") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/sysrand.read" (Indicator: "crypto/internal/sysrand.read") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/sysrand.Read.deferwrap1" (Indicator: "crypto/internal/sysrand.Read.deferwrap1") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/entropy.Depleted" (Indicator: "crypto/internal/entropy.Depleted") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/fips140only.init" (Indicator: "crypto/internal/fips140only.init") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/internal/boring/sig.StandardCrypto" (Indicator: "crypto/internal/boring/sig.StandardCrypto") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/rand.init.0" (Indicator: "crypto/rand.init.0") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin Observed string: "crypto/rand.(*reader).Read" (Indicator: "crypto/rand.(*reader).Read") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin, Observed string: "crypto/internal/boring.Unreachable" (Indicator: "crypto/internal/boring.Unreachable") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin, Observed string: "crypto/internal/fips140.fatal" (Indicator: "crypto/internal/fips140.fatal") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin2f:T504,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to decrypt data using RSA (Dotnet String) Matched sigs: Able to perform cryptographic operations Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to encrypt data using RSA (Dotnet String) Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: YARA signature match - AES encryption30:T426c,Found XOR loop in file "sample.bin" at offset 87154; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1583760; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1698828; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1951987; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2081131; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2084225; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2377459; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2593941; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3330322; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3349388; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3354560; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4087568; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4267747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4436964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4518345; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4532451; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4553761; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4611037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4972993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4979350; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5070237; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5141255; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5325527; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5400009; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5494461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5623844; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5656937; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5664217; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5677271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5713308; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5952843; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5998176; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6008743; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6023742; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6070498; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6077269; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6254740; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6304801; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6337264; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6344598; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6540859; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6607611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6643911; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6648519; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6678945; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6708319; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6793776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6832409; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6874076; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6875726; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6914325; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6936481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6952013; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7048963; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7091423; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7092136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7377791; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7380571; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1919539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1921190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2945548; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3007705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3020553; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3046020; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3205618; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3205623; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3328861; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3336470; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3336599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3388233; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3400969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3426492; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3529317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3583064; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3583804; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3584183; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3584624; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3585009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3649253; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3658340; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3658388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3658444; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3878404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3993583; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4182280; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4494057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4525091; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4528539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4618883; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4839399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4848792; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4912057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5092503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5264943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5319588; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5379040; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5450676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5502933; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5503714; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5631111; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5662541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5752819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5754361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5763924; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5820929; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5838784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5840010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5952314; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6018182; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6030132; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6053156; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6219403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6228390; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6289081; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6319769; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6466858; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6494923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6555937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6564635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6614956; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6706002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6935384; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6966441; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6997402; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7027680; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7069927; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7095351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7169179; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7378621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7647032; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 187542; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226121; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226881; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229043; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 252369; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 272496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 422277; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 422973; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 423614; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 433993; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 930636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1250756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1419900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1700184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1746208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1821304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2055168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2155577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2590969; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3008332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3021180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3034447; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3040943; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3041079; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3058550; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3076111; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3207950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3259769; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3388860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3401596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3414919; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3421415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3421551; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3439022; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3446912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3459262; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3488010; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3562182; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3641766; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3676873; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4267728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4680194; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4737886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4752057; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4785078; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4874972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4881482; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4917456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4955390; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4976212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4979888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5004183; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5074115; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5074181; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5267991; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5280161; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5285528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5286376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5333403; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5352867; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5363582; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5445048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5469236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5471330; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5563766; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5652698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5727677; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5759866; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5775674; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5865572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5963189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5992997; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6041525; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6139691; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6197519; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6220096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6294103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6484162; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6697830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6756459; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6862311; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6947091; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6955167; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6974304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7128056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7165346; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7170798; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7275187; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7380552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7445626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7448415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7448662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7463324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7466665; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7469457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7469704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7647928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7656340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7692522; code bytes = 803031:T46c,file/memory contains long string with (Indicator: "GetCommandLine"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "GetCommandLineArgs" (Indicator: "GetCommandLine"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetCommandLine"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")32:T4ae,file/memory contains long string with (Indicator: "WTSFreeMemory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "ProcessIdToSessionId"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "WTSEnumerateSessions"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "ProcessIdToSessionId" (Indicator: "ProcessIdToSessionId"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "WTSEnumerateSessions" (Indicator: "WTSEnumerateSessions"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "WTSFreeMemory" (Indicator: "WTSFreeMemory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "WTSFreeMemory"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "WTSEnumerateSessions"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")33:T405,file/memory contains long string with (Indicator: "FreeSid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "FreeSid"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "CheckTokenMembership"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")34:T6f3,Found system information discovery API: "GetSystemInfo" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found system information discovery API: "syscall.GetEnvironmentStrings" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found system information discovery API: "GetUserObjectInformation" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found system information discovery API: "GetMonitorInfo" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found system information discovery API: "GetUserObjectInformationW" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found system information discovery API: "ExpandEnvironmentStringsW" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp" Found system information discovery API: "syscall.GetEnvironmentStrings" in "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp"35:T14af,file/memory contains long string with (Indicator: "enumwindows"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "enumchildwindows"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CommandSendMessage" (Indicator: "sendmessage"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "HasSendMessageCapability" (Indicator: "sendmessage"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "EnumWindowStationProc" (Indicator: "enumwindows"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "EnumWindowsProc" (Indicator: "enumwindows"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "WmsgSendMessage" (Indicator: "sendmessage"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "PostMessage" (Indicator: "postmessage"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "EnumWindowStations" (Indicator: "enumwindows"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "SendMessageTimeout" (Indicator: "sendmessage"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "FindWindowEx" (Indicator: "findwindow"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "SendMessage" (Indicator: "sendmessage"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "SYSTEMROOT=broken pipealarm clockbad messagefile existsbad addressRegCloseKeyCloseHandleCreateFileWDeleteFileWExitProcessFreeLibrarySetFileTimeVirtualLockWSARecvFromclosesocketgetpeernamegetsocknamecrypt32.dllmswsock.dllsecur32.dllshell32.dlluserenv.dllshort writeProcessPrngMoveFileExWNetShareAddNetShareDelassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailunspecifiedcgocall nil s.nelems= of size runtime: p ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: running < 0runtime: g : frame.sp=created by i/o timeoutsechost.dllversion.dllGetFileTimeSetCommMaskVirtualFreeNetUserEnumCoGetObjectEnumWindowsMessageBoxWgocachehashgocachetesthttp2clienthttp2serverrandseednoparchive/tartls10servercrypto/x509archive/zipClassHESIODexit status can't happeninvalid slothost is downillegal seekGetLengthSidGetLastErrorGetStdHandleGetTempPathWLoadLibraryWReadConsoleWSetEndOfFileTransmitFileGetAddrInfoWadvapi32.dlliphlpapi.dllkernel32.dllnetapi32.dllOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilesweepWaiterscleanupQueuetraceStringsspanSetSpinemspanSpecialtraceTypeTabgcBitsArenasmheapSpecialgcpacertraceharddecommitmadvdontneeddumping heapchan receivesynctest.Runcleanup wait span.limit= span.state=bad flushGen MB stacks, scan: total scan: class worker mode nDataRoots= nSpanRoots= wbuf1= wbuf2= gcscandone runtime: gp= found at *( s.elemsize= B (" (Indicator: "enumwindows"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetFileValidDataSetPriorityClassVirtualProtectExRtlGetCurrentPebEnumChildWindowsGetDesktopWindowGetGUIThreadInfoWinVerifyTrustExGODEBUG: value "allowmultiplevcshttpcookiemaxnumRCodeFormatErrorwinreadlinkvolumeexec: killing Cmdexec: not startedpermission deniedwrong medium typeno data availableexec format errorLookupAccountSidWDnsRecordListFreeGetCurrentProcessGetShortPathNameWWSAEnumProtocolsWRegLoadMUIStringWgoroutine profileAllThreadsSyscallcontainermaxprocsGC assist markingselect (no cases)sync.RWMutex.Lockwait for GC cycletrace proc statussync.(*Cond).Wait: missing method notetsleepg on g0bad TinySizeClassimmortal metadataruntime: pointer g already scannedmark - bad statusscanobject n == 0swept cached spanmarkBits overflowruntime: summary[runtime: level = p.searchAddr = RtlGetCurrentPeb" (Indicator: "enumchildwindows"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")36:T775,"__GetVersion" (Indicator: "GetVersion"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "1681280984,5404,3024,,RtlGetVersion,NTDLL.dll,"01:07:05.531",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00008124.00000000.257901.045F0000.00000004.mdmp") file/memory contains long string with (Indicator: "GetVersion"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "internal/syscall/windows.rtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")3a:T531,file/memory contains long string with (Indicator: "OpenSCManager"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "QueryServiceStatus"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "EnumServicesStatus"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "EnumDependentServices"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "OpenSCManager" (Indicator: "OpenSCManager"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "OpenSCManager"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "QueryServiceStatus"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")3b:T16bc,"b__2_0" (Indicator: "LoadResource"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "b__3_0" (Indicator: "LoadResource"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "b__1" (Indicator: "LoadResource"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "LoadResourcePack" (Indicator: "LoadResource"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "LoadResourcesFromStream" (Indicator: "LoadResource"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "LoadResourcePacks" (Indicator: "LoadResource"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "b__0_0" (Indicator: "LoadResource"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "LoadResourcePackFromFile" (Indicator: "LoadResource"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "FindResource" (Indicator: "FindResource"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "LoadResource"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "LockResource"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "FindResource"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")41:T544,file/memory contains long string with (Indicator: "GetCommandLine"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CommandLineToArgv"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.GetCommandLine" (Indicator: "GetCommandLine"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetCommandLineArgs" (Indicator: "GetCommandLine"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CommandLineToArgv"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "syscall.GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")42:T639,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "OpenThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "ResumeThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CreateThreadRunContext" (Indicator: "CreateThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "OpenThread"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "ResumeThread"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")43:T1766,"buffer for done generationtrace: non-empty full trace buffer for next generationgoroutine running on other thread; stack unavailablebytes.Buffer: reader returned negative count from Readinternal error: negative process handle reference countmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesstrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= cannot run executable found relative to current directory (set GODEBUG=execwait=2 to capture stacks for debugging)runtime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds max" in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin "SYSTEM\CurrentControlSet\Services\" in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin "SOFTWARE\Microsoft\Cryptography" in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin "uSoftware\Policies\Microsoft\Windows\Installer" in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin "buffer for done generationtrace: non-empty full trace buffer for next generationgoroutine running on other thread; stack unavailablebytes.Buffer: reader returned negative count from Readinternal error: negative process handle reference countmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesstrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= cannot run executable found relative to current directory (set GODEBUG=execwait=2 to capture stacks for debugging)runtime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds ma" in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin "Software\Policies\Microsoft\Windows\Installer" in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin "ease install the .NET Framework then run this installer again.REMOVE OR NOT NEW_VERSIONInstallation cannot continue. There is a later version of this product installed. Please manually uninstall the existing version if you wish to install this version.#Default.cabARPPRODUCTICONARPNOREPAIRyesARPNOMODIFYALLUSERS1ManufacturerScreenConnect SoftwareProductCode{B292C5EA-BF5F-4280-B056-1670FB10BB1D}ProductLanguage1033ProductNameProductVersion{20AB6B9A-CF56-446C-A5AB-99B56F58BAFF}SecureCustomPropertiesARPNOMODIFY;ARPNOREPAIR;NETFRAMEWORK20;NETFRAMEWORK40CLIENT;NEW_VERSION;OLD_PRODUCT_1;OLD_PRODUCT_2;OLD_PRODUCT_3reg239C9CCDE4AB59853602A60F6F05D51B[URL_SCHEME]URL ProtocolregC511015E3F744DB5C5D9473BF2B6E27BUseOriginalUrlEncoding#1regED314AE69CE5D835D523FB365C82C36B[URL_SCHEME]\shell\open\command"[INSTALLLOCATION]ScreenConnect.WindowsClient.exe" "%1"reg3831C0C36D9CE44BC3E6FAE6F161BEA8System\CurrentControlSet\Control\SafeBoot\Network\[SERVICE_NAME]ServiceregB33BA5DF8D6A3B0A5B5032B6CB3E561BSYSTEM\CurrentControlSet\Contro" in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin "\LsaAuthentication Packages[~][#ScreenConnect.WindowsAuthenticationPackage.dll]reg86A6324C5FADB6CB634CB54F9A254136CLSID\[CREDENTIAL_PROVIDER_CLASS_ID][ProductName] Credential ProviderregA0D3A6DD84118D3DB3724140CDD67EB3CLSID\[CREDENTIAL_PROVIDER_CLASS_ID]\InprocServer32[#ScreenConnect.WindowsCredentialProvider.dll]regBE7B0E97E26F674069B85EA56F7ED91AThreadingModelApartmentreg6D36DB0A1418FE132B81E493007857D7-regCC3768849A0489209CB6D1FE238BF1F1Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\[CREDENTIAL_PROVIDER_CLASS_ID]reg685500C4A1A36BBDF1BB32EEE98CBEDESoftware\Microsoft\NET Framework Setup\NDP\v2.0.50727InstallSOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Client[SERVICE_NAME]restartnoneRemote Control"[SERVICE_CLIENT_LAUNCH_PARAMETERS]"{0C94448B-0C9E-4112-AC7D-B00E6BA76D82}0.0.0.0125.0.0.0OLD_PRODUCT_1{1F85D7FE-5576-41EE-9480-E3F7F9C31B8B}OLD_PRODUCT_2OLD_PRODUCT_3NEW_VERSION" in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin "bytes.Buffer: reader returned negative count from Readinternal error: negative process handle reference countmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesstrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= cannot run executable found relative to current directory (set GODEBUG=execwait=2 to capture stacks for debugging)runtime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds maximumGODEBUG=execwait=2 detected a leaked exec.Cmd created by:" in Source: 00000000-00008124.00000000.257901.ED27D000.00000002.mdmp44:T4d5,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "golang.org/x/sys/windows.LoadLibraryEx" (Indicator: "LoadLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "golang.org/x/sys/windows._LoadLibraryEx" (Indicator: "LoadLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "golang.org/x/sys/windows.LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "golang.org/x/sys/windows._LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")45:T750,"g__CreateAndConnectNamedPipe|97_0" (Indicator: "ConnectNamedPipe"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "g__WaitAndConnectNamedPipe|97_1" (Indicator: "ConnectNamedPipe"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CreatePipe"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateNamedPipe"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "ConnectNamedPipe"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "GetNamedPipe"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "syscall.CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")4b:T954,file/memory contains long string with (Indicator: "wsastartup"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "wsacleanup"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "gethostbyname"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: " send "; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: " socket "; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "Failed to bind to the CLR. Error code 0x%X" (Indicator: " bind "; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "App: %ls found running, %d processes, attempting to send message." (Indicator: " send "; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "failed to send progress message" (Indicator: " send "; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "failed to get message to send to users when server reboots due to service failure." (Indicator: " send "; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "wsastartup"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "wsacleanup"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "gethostbyname"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: " socket "; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")4c:T1484,Heuristic match: "*abi.name" Heuristic match: "*godebugs.info" Pattern match: "golang.org/x/sys/windows" Pattern match: "golang.org/x/net/dns/dnsmessage" Pattern match: "https://go.dev/issue/66821" Pattern match: "depgolang.org/x/sysv0.21.0h1:rf+pyz3dagsqaxau1cbc7catzg4ebc4uieihkxbzvws=build-buildmode=exebuild-compiler=gcbuild-ldflags=-s" Heuristic match: "internal/abi.name.name" Heuristic match: "type:.eq.internal/godebugs.info" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.srcfunc.name" Pattern match: "https://feedback.screenconnect.com/feedback.axd" Heuristic match: "errors.is" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.int32" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[sync.poolchainelt" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Pattern match: "eq.sync/atomic.pointer[internal/bisect.dedup" Heuristic match: "internal/godebug.(*setting).name" Pattern match: "eq.sync/atomic.pointer[internal/godebug.value" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Pattern match: "eq.io/fs.patherror" Pattern match: "eq.sync/atomic.pointer[os.dirinfo" Heuristic match: "unicode.to" Pattern match: "eq.os/exec.error" Pattern match: "eq.os/exec.wrappederror" Pattern match: "eq.os/exec.ctxresult" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[*internal/abi.type,interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.*internal/abi.type,go.shape.interface" Pattern match: "eq.net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.node[net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.entry[net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.indirect[net/netip.addrdetail" Pattern match: "hash.net/netip.addrdetail" Pattern match: "eq.sync/atomic.pointer[unique.entry[go.shape.struct" Pattern match: "golang.org/x/net/dns/dnsmessage.init" Pattern match: "golang.org/x/sys/windows.init" Pattern match: "golang.org/x/sys/windows.(*dllerror).error" Pattern match: "golang.org/x/sys/windows.(*dllerror).unwrap" Pattern match: "golang.org/x/sys/windows.loaddll" Pattern match: "golang.org/x/sys/windows.(*dll).findproc" Pattern match: "golang.org/x/sys/windows.byteptrfromstring" Pattern match: "golang.org/x/sys/windows.(*lazydll).load" Pattern match: "golang.org/x/sys/windows.(*lazydll).load.deferwrap1" Pattern match: "golang.org/x/sys/windows.(*lazyproc).find" Pattern match: "golang.org/x/sys/windows.(*lazyproc).find.deferwrap1" Pattern match: "golang.org/x/sys/windows.initcandosearchsystem32" Pattern match: "golang.org/x/sys/windows.(*lazydll).newproc" Pattern match: "golang.org/x/sys/windows.loadlibraryex" Pattern match: "golang.org/x/sys/windows.candosearchsystem32" Pattern match: "golang.org/x/sys/windows.isbasename" Pattern match: "golang.org/x/sys/windows.getsystemdirectory" Pattern match: "golang.org/x/sys/windows.utf16tostring" Pattern match: "golang.org/x/sys/windows.byteslicefromstring" Pattern match: "golang.org/x/sys/windows.utf16ptrfromstring" Pattern match: "golang.org/x/sys/windows.utf16fromstring" Pattern match: "golang.org/x/sys/windows.getstdhandle" Pattern match: "golang.org/x/sys/windows.(*lazyproc).addr" Pattern match: "golang.org/x/sys/windows.(*lazyproc).mustfind" Pattern match: "golang.org/x/sys/windows.(*proc).addr" Pattern match: "golang.org/x/sys/windows.errnoerr" Pattern match: "golang.org/x/sys/windows._loadlibraryex" Pattern match: "eq.golang.org/x/sys/windows.dllerror" Pattern match: "eq.golang.org/x/sys/windows.dll" Pattern match: "eq.golang.org/x/sys/windows.proc" Pattern match: "eq.golang.org/x/sys/windows.lazydll" Pattern match: "eq.golang.org/x/sys/windows.lazyproc" Pattern match: "golang.org/x/sys/windows/registry.init" Heuristic match: "os.(*file).name" Pattern match: "golang.org/x/net/dns/dnsmessage/message.go" Pattern match: "golang.org/x/sys@v0.21.0/windows/syscall_windows.go" Pattern match: "golang.org/x/sys@v0.21.0/windows/zsyscall_windows.go" Pattern match: "golang.org/x/sys@v0.21.0/windows/dll_windows.go" Pattern match: "golang.org/x/sys@v0.21.0/windows/syscall.go" Pattern match: "golang.org/x/sys@v0.21.0/windows/security_windows.go" Pattern match: "golang.org/x/sys@v0.21.0/windows/registry/zsyscall_windows.go" Heuristic match: "+*.sv" Pattern match: "eedback.screenconnect.com/feedback.axd" Pattern match: "feedback.screenconnect.com/feedback.axd" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "golang.org/x/sys" Pattern match: "eq.os/exec.goroutinestatus"4d:T6f7,file/memory contains long string with (Indicator: "GetDesktopWindow"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "b__0" (Indicator: "GetDesktopWindow"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "b__1" (Indicator: "GetDesktopWindow"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CreateDC" (Indicator: "CreateDC"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetDesktopWindowHandles" (Indicator: "GetDesktopWindow"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetDesktopWindow"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")4e:T957,Found registry query API: "RegOpenKey (in long string)" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found registry query API: "RegQueryValue (in long string)" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found registry query API: "RegNotifyChangeKeyValue (in long string)" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found registry query API: "syscall.RegOpenKeyEx" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found registry query API: "syscall.RegQueryValueEx" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found registry query API: "syscall.RegEnumKeyEx" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found registry query API: "RegQueryValueEx" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found registry query API: "<11>__RegOpenKeyEx" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found registry query API: "RegOpenKeyExW" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found registry query API: "RegEnumKeyExW" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found registry query API: "RegEnumValueW" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found registry query API: "RegQueryInfoKeyW" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found registry query API: "RegQueryValueExW" in file "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin" Found registry query API: "RegOpenKey (in long string)" in "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp" Found registry query API: "RegQueryValue (in long string)" in "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue (in long string)" in "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp" Found registry query API: "syscall.RegOpenKeyEx" in "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp" Found registry query API: "syscall.RegQueryValueEx" in "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp" Found registry query API: "syscall.RegEnumKeyEx" in "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp"4f:Te5e,Found string "chacha8" (Indicator: "chacha"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "*aes.CTR" (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "*aes.Block" (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "*aes.block" (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "*aes.KeySizeError" (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "*aes.blockExpanded" (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "crypto/internal/fips140/aes" (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "3des"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "aeshashbody" (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "crypto/internal/fips140/aes.init" (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "crypto/internal/fips140/aes.KeySizeError.Error" (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "crypto/internal/fips140/aes.newOutlined" (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "crypto/internal/fips140/aes.newOutlined" (Indicator: "aes.new"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "crypto/internal/fips140/aes.(*Block).BlockSize" (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "crypto/internal/fips140/aes.init.0" (Indicator: "aes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin")50:T640,file/memory contains long string with (Indicator: "FindFirstFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "FindNextFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.FindFirstFile" (Indicator: "FindFirstFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "FindFirstFile"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "FindNextFile"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "syscall.FindFirstFile" (Indicator: "FindFirstFile"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")51:T10f0,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "Module32Next"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "Thread32Next"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "EnumProcesses"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "Thread32First"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "Process32First"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "EnumProcessModules"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "QueryInformationProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetCurrentProcessMainModuleFileName" (Indicator: "GetCurrentProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetCurrentProcessSessionID" (Indicator: "GetCurrentProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetCurrentProcessTokenInformation" (Indicator: "GetCurrentProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin")52:T1138,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetSystemDirectory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetFileVersionInfo"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetFileVersionInfoSize"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "internal/syscall/windows.GetSystemDirectory" (Indicator: "GetSystemDirectory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.GetFileAttributesEx" (Indicator: "GetFileAttributes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.GetFileAttributes" (Indicator: "GetFileAttributes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.GetTempPath" (Indicator: "GetTempPath"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "internal/syscall/windows.GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "internal/syscall/windows.GetTempPath2" (Indicator: "GetTempPath"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "os.newFileStatFromGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "golang.org/x/sys/windows.GetSystemDirectory" (Indicator: "GetSystemDirectory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetTempPath2" (Indicator: "GetTempPath"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin")53:T10c8,file/memory contains long string with (Indicator: "NetUserEnum"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetUserName"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "WTSQueryUserToken"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "NtQueryInformationProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "LsaGetLogonSessionData" (Indicator: "LsaGetLogonSessionData"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "<1>__OpenProcessToken" (Indicator: "OpenProcessToken"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "NetGetJoinInformation" (Indicator: "NetGetJoinInformation"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "WTSQuerySessionInformation" (Indicator: "WTSQuerySessionInformation"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetUserObjectInformation" (Indicator: "GetUserObjectInformation"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")54:T539,Found string "password" (Indicator: "password"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "secretBytes" (Indicator: "secret"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "secretKey" (Indicator: "secret"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "usri4_password_expired" (Indicator: "password"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "usri1_password" (Indicator: "password"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "usri1003_password" (Indicator: "password"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "usri4_password" (Indicator: "password"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "usri1_password_age" (Indicator: "password"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "usri4_password_age" (Indicator: "password"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "password"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin")55:T42a,Found string "SELECT ProcessId, ParentProcessId FROM Win32_Process" (Indicator: " Win32_Process"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found string "SELECT * FROM Win32_GroupUser WHERE GroupComponent="Win32_Group.Domain='" (Indicator: " Win32_Group"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found string "SELECT * FROM Win32_GroupUser WHERE GroupComponent="Win32_Group.Domain='" (Indicator: " Win32_GroupUser"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found string "SELECT * FROM Win32_UserAccount WHERE Name='" (Indicator: " Win32_UserAccount"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found string "d, ParentProcessId FROM Win32_Process" (Indicator: " Win32_Process"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin"), Found string "OM Win32_UserAccount WHERE Name='" (Indicator: " Win32_UserAccount"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin")56:T649,file/memory contains long string with (Indicator: "DeleteFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "RemoveDirectory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.DeleteFile" (Indicator: "DeleteFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.RemoveDirectory" (Indicator: "RemoveDirectory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "DeleteFileTransacted" (Indicator: "DeleteFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "RemoveDirectory"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "syscall.DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "syscall.RemoveDirectory" (Indicator: "RemoveDirectory"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")57:T589,file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "LookupPrivilegeValue"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin")58:T6f8,file/memory contains long string with (Indicator: "SetFileAttributes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "SetInformationFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "NtSetInformationFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.SetFileAttributes" (Indicator: "SetFileAttributes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "internal/syscall/windows.NtSetInformationFile" (Indicator: "SetInformationFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "internal/syscall/windows.NtSetInformationFile" (Indicator: "NtSetInformationFile"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "SetFileAttributes"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "syscall.SetFileAttributes" (Indicator: "SetFileAttributes"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "internal/syscall/windows.NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "internal/syscall/windows.NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")59:T1a5a,file/memory contains long string with (Indicator: "CopySid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "FreeSid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "EqualSid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "IsValidSid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetLengthSid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "RevertToSelf"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "IsWellKnownSid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "MakeAbsoluteSD"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "DuplicateToken"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "SetEntriesInAcl"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "AdjustTokenGroups"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "IsTokenRestricted"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "CreateWellKnownSid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "MakeSelfRelativeSD"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "SetKernelObjectSecurity"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "InitializeSid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorDacl"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorSacl"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorDacl"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorSacl"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorGroup"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorOwner"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorGroup"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorOwner"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorLength"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorControl"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "InitializeSecurityDescriptor"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorControl"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "GetSecurityDescriptorRMControl"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "SetSecurityDescriptorRMControl"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "b__8_0" (Indicator: "ImpersonateLoggedOnUser"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin")5a:T82d,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "ExitProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "TerminateProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.TerminateProcesses" (Indicator: "TerminateProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "syscall.TerminateProcess" (Indicator: "TerminateProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "b__161_0" (Indicator: "TerminateProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "TryTerminateProcess" (Indicator: "TerminateProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "InstallerActions!ScreenConnect.ClientInstallerActions.TerminateProcesses" (Indicator: "TerminateProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") Found reference to API "TerminateProcesses" (Indicator: "TerminateProcess"; File: "4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin") file/memory contains long string with (Indicator: "TerminateProcess"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp") Found reference to API "syscall.TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00008124.00000000.257901.ED27D000.00000002.mdmp")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790355671283,"unified_at":"2026-09-25T17:01:11.283Z","metadata":{"hashes":{"sha256":"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00","sha1":"bcccf67983bc32a327b58e02ef1ce9a8a94d5c15","md5":"c6b330d0048c8e3449049f8285d7938d","sha512":"be56ae79d709a0bd02a5d3317de24020ac1720b1f4d957ed2656d5f5709eb1698f350f019150d466daee665e66882b1a258165f14e71f2fbf52da234c607b699","ssdeep":"98304:EQHbG3aWzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl7:EubqhfefPtHxcp9ym3nltDUJVF","ssdeep_chunks":["98304:EQHbG3a","98304:QHbG3aW","98304:HbG3aWz","98304:bG3aWzI","98304:G3aWzIu","98304:3aWzIus","98304:aWzIus6","98304:WzIus6e","98304:zIus6ef","98304:Ius6efP","98304:us6efPU","98304:s6efPUI","98304:6efPUId","98304:efPUIdo","98304:fPUIdoa","98304:PUIdoax","98304:UIdoaxc","98304:Idoaxcp","98304:doaxcp8","98304:oaxcp8w","98304:axcp8wy","98304:xcp8wy5","98304:cp8wy5c","98304:p8wy5c3","98304:8wy5c3t","98304:wy5c3tr","98304:y5c3trG","98304:5c3trGO","98304:c3trGOl","98304:3trGOlk","98304:trGOlkQ","98304:rGOlkQ5","98304:GOlkQ5D","98304:OlkQ5DU","98304:lkQ5DUO","98304:kQ5DUOg","98304:Q5DUOgJ","98304:5DUOgJ9","98304:DUOgJ9z","98304:UOgJ9zl","98304:OgJ9zl7","196608:EQHbG3a","196608:QHbG3aW","196608:HbG3aWz","196608:bG3aWzI","196608:G3aWzIu","196608:3aWzIus","196608:aWzIus6","196608:WzIus6e","196608:zIus6ef","196608:Ius6efP","196608:us6efPU","196608:s6efPUI","196608:6efPUId","196608:efPUIdo","196608:fPUIdoa","196608:PUIdoax","196608:UIdoaxc","196608:Idoaxcp","196608:doaxcp8","196608:oaxcp8w","196608:axcp8wy","196608:xcp8wy5","196608:cp8wy5c","196608:p8wy5c3","196608:8wy5c3t","196608:wy5c3tr","196608:y5c3trG","196608:5c3trGO","196608:c3trGOl","196608:3trGOlk","196608:trGOlkQ","196608:rGOlkQ5","196608:GOlkQ5D","196608:OlkQ5DU","196608:lkQ5DUO","196608:kQ5DUOg","196608:Q5DUOgJ","196608:5DUOgJ9","196608:DUOgJ9z","196608:UOgJ9zl","196608:OgJ9zl7","98304:Eubqhfe","98304:ubqhfef","98304:bqhfefP","98304:qhfefPt","98304:hfefPtH","98304:fefPtHx","98304:efPtHxc","98304:fPtHxcp","98304:PtHxcp9","98304:tHxcp9y","98304:Hxcp9ym","98304:xcp9ym3","98304:cp9ym3n","98304:p9ym3nl","98304:9ym3nlt","98304:ym3nltD","98304:m3nltDU","98304:3nltDUJ","98304:nltDUJV","98304:ltDUJVF"],"imphash":"d42595b695fc008ef2c56aabd8efd68e"},"file_info":{"file_name":"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":7694904,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1773850969000,"last_seen":1774085005000,"last_multi_scan":1774085005000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":92},"sandbox_signatures":{"informative_count":212,"suspicious_count":15,"malicious_count":3,"total":230},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.MalwareX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Adware.Tedy.9581","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Sabsik_EN_A_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Adware.Tedy.9581 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/ConnectWiseControl.IJ.gen trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Emotet.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"RemoteTool ( 006dca6b1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABRisk.NRTS-8478","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Genus.JIZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Adware.Tedy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"informative","value":"May contain SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to set/delete MS-DOS device name (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"informative","value":"Contains ability to add users to a group (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains ability to enumerate multimedia device resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to perform Process Doppelganging (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to decrypt data using RSA (Dotnet String)"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to encrypt data using RSA (Dotnet String)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"Able to perform cryptographic operations"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Contains ability to block user input (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Hidden Users","attack_id":"T1564.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/002","identifiers":[{"type":"suspicious","value":"Contains ability to hide user accounts"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"The input sample contains a known anti-VM trick"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Credential Access","technique":"Security Account Manager","attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"Local Groups","attack_id":"T1069.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/001","identifiers":[{"type":"informative","value":"References to WMI query strings used for permission groups discovery"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Contains ability to copy files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to monitor clipboard data (API string)"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"},{"type":"informative","value":"Contains ability to delete users from a group (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Impact","technique":"Endpoint Denial of Service","attack_id":"T1499","attack_id_wiki":"https://attack.mitre.org/techniques/T1499","identifiers":[{"type":"informative","value":"Contains ability to lock the workstation's display (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"file/memory contains long string(File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found string \"DeleteService\" (File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string(Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"SetupDiGetClassDevs\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"SetThreadToken\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"<1>__OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"RegSetValue\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"file/memory contains long string with (Indicator: \"ControlService\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"ChangeServiceConfig\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"ChangeServiceConfig2\" (Indicator: \"ChangeServiceConfig\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"ChangeServiceConfig\" (Indicator: \"ChangeServiceConfig\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"OpenService\" (Indicator: \"OpenService\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"OpenServiceControlManager\" (Indicator: \"OpenService\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"OpenServiceRegistryKey\" (Indicator: \"OpenService\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProc\" (Indicator: \"CallWindowProc\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"__ConvertFromBase64StringFlexible\" (Indicator: \"FromBase64String\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.CreateDecryptor\" in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-357","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.RSACryptoServiceProvider.set_EncryptedSecretKey\" in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-358","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089.CreateDecryptor\" in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptUnprotectData\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"EncryptRSA\" (Indicator: \"EncryptRSA\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.13576","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2f","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"$32","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found string \"QueryServiceStatus\" (File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found string \"QueryServiceConfig2W\" (File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string(Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"file/memory contains long string with (Indicator: \"GetDiskFreeSpace\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"GetDiskFreeSpaceEx\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"file/memory contains long string with (Indicator: \"GetUserPreferredUILanguages\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"GetKeyboardLayoutName\" (Indicator: \"GetKeyboardLayout\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"__CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-449","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"file/memory contains long string with (Indicator: \"NetUserAdd\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAddMembers\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"NetUserAdd\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"CreateDirectory\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"RegDisablePredefinedCache\" (Indicator: \"RegDisablePredefinedCache\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"<12>__RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"file/memory contains long string with (Indicator: \"ShellExecute\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"ShellExecute\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"LogonUser\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"MoveFileTransacted\" (Indicator: \"MoveFile\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"MoveFileEx\" (Indicator: \"MoveFile\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"<1>__OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"file/memory contains long string with (Indicator: \"GetShellWindow\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"GetWindowThreadProcessId\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"file/memory contains long string with (Indicator: \"StartService\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"StartServiceCtrlDispatcher\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"StartService\" (Indicator: \"StartService\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"StartService\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$43","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\Pipe\\TerminalServer\\SystemExecSrvr\\\n Found string - \\\\.\\pipe\\","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"bytes.Buffer: reader returned negative count from Readinternal error: negative process handle reference countmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zonesstrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= cannot run executable found relative to current directory (set GODEBUG=execwait=2 to capture stacks for debugging)runtime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds maximumGODEBUG=execwait=2 detected a leaked exec.Cmd created by:\" in Source: 00000000-00008124.00000000.257901.ED27D000.00000002.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"k__BackingField\" (Indicator: \"nthash\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found string \"k__BackingField\" (Indicator: \"nthash\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found string \"get_ScreenshotContentHash\" (Indicator: \"nthash\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found string \"set_ScreenshotContentHash\" (Indicator: \"nthash\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found string \"get_CurrentScreenshotContentHash\" (Indicator: \"nthash\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found string \"set_CurrentScreenshotContentHash\" (Indicator: \"nthash\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1003.002","relevance":1,"id":"string-867","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"1681280984,5404,3024,,RtlGetVersion,NTDLL.dll,\"01:07:05.531\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00008124.00000000.257901.045F0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"RtlGetVersion\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"AddClipboardFormatListener\" (File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"VkKeyScan\" (Indicator: \"VkKeyScan\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"__OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00008124.00000000.257901.045F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"file/memory contains long string with (Indicator: \"CoGetObject\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"WTSQueryUserToken\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"ImpersonateLoggedOnUser\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"SetupDiDestroyDeviceInfoList\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to set/delete MS-DOS device name (API string)","description":"file/memory contains long string with (Indicator: \"DefineDosDevice\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"DefineDosDevice\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-466","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00008124.00000000.257901.ED27D000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"System Security","name":"May contain SSL certificate","description":"\"(?s)-----BEGIN CERTIFICATE-----([^-]*)-----END CERTIFICATE-----\" (Indicator: \"----begin certificate----\") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\n \")-----BEGIN CERTIFICATE-----([^-]*)-----END CERTIFICATE-----\" (Indicator: \"----begin certificate----\") in Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin","origin":"File/Memory","mitre_attack_id":"T1588.004","relevance":1,"id":"string-574","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"file/memory contains long string with (Indicator: \"ExitWindows\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"InitiateSystemShutdown\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"ExitWindows\" (Indicator: \"ExitWindows\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"ExitWindows\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"file/memory contains long string with (Indicator: \"OpenMutex\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"CreateMutex\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"ReleaseMutex\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n file/memory contains long string with (Indicator: \"OpenMutex\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"CreateMutex\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"ReleaseMutex\"; Source: \"00000000-00008124.00000000.257901.ED27D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"signal\" (Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin, API is part of module: MSVCRT.DLL)\n Found string \"remove\" (Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin, API is part of module: MSVCRT.DLL)\n Found string \"WSAIoctl\" (Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin, API is part of module: WS2_32.DLL)\n Found string \"GetFileType\" (Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin, API is part of module: KERNELBASE.DLL)\n Found string \"GetFileInformationByHandle\" (Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin, API is part of module: KERNELBASE.DLL)\n Found string \"timeEndPeriod\" (Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin, API is part of module: WINMM.DLL)\n Found string \"NtCancelWaitCompletionPacket\" (Source: 4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin, API is part of module: NTDLL.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\" has section name .data with entropy \"7.383687272256984\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Able to perform cryptographic operations","description":"Found strings that indicate potentially cryptographic operations: createencryptor\n createdecryptor\n computehash\n cryptography\n md5cryptoserviceprovider\n rijndaelmanaged","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-962","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT ProcessId, ParentProcessId FROM Win32_Process\" (Indicator: \" win32_process\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")\n \"d, ParentProcessId FROM Win32_Process\" (Indicator: \" win32_process\"; File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"suspicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"sample.bin\" (Offset: 3879960)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/26 Antivirus vendors marked sample as malicious (46% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\" (Indicator: \"software\\microsoft\\windows nt\\currentversion\\winlogon\"; in File: \"4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00.bin\")","origin":"File/Memory","mitre_attack_id":"T1547","relevance":5,"id":"string-184","sources":[{"report_type":"sandbox","report_id":"69be63920c315593530ec544"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"