21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 62fb38640d60… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 62fb38640d60…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":6,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==23:T473,Observed system executable string:"tack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x] (types from different packages)28421709430404007434844970703125C:\Windows\System32\conhost.exe CertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before NextWSAGetOverlappedResult not found" not supported for cpu option "bufio: invalid use of UnreadBytebufio: invalid use of UnreadRunecrypto/aes: input not full blockfail to seek to string table: %vfail to seek to symbol table: %vinvalid limiter event type foundnumerical argument out of domainpanic while printing panic valuereflect.nameFrom: tag too long: removespecial on invalid pointerresource temporarily unavailableruntime.semasleep wait_abandonedruntime: failed to release pagesruntime: fixalloc size too largeruntime: mcall function returnedruntime: newstack called from g=runtime: root level max pages = runtime: setevent failed; errno=runtime: stack split at bad timeruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]24:T1ece,Observed api string:"chan<-efencelistenobjectpopcntrdtscpreadatselectsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaUNKNOWNWSARecvWSASendtypes value=connectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 48828125AcceptExArmenianBalineseBopomofoBugineseCancelIoCherokeeCyrillicDuployanEthiopicExtenderGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiParseIntPhags_PaReadFileTagbanwaTai_ThamTai_VietTifinaghUgariticWSAIoctl[signal stack=[cgocheckcs deadlockeax eb which can Copies a security identifier (SID) to a buffer"[Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin] Observed api string:"goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit 152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWResumeThreadRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegc entersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollableraceFiniLockreleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode != sweepge which can Returns the length in bytes of a valid security identifier (SID)"[Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin] Observed api string:"goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit 152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWResumeThreadRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegc entersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollableraceFiniLockreleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode != sweepge which can Terminates the impersonation of a client application"[Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin] Observed api string:"too many linkstoo many usersunexpected EOFunknown methodunreachable: unsafe.Pointerwinapi error #work.full != 0 with GC prog 476837158203125ASCII_Hex_DigitCreateHardLinkWDeviceIoControlDuplicateHandleFailed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWHanifi_RohingyaImpersonateSelfLoadLibraryExA which can Obtains an access token that impersonates the security context of the calling process"[Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin] Observed api string:"CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Square runtime stack: bad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapnewmHandoff.lockno route to hostnon-Go function object is remotereflect mismatchremote I/O errorruntime: g: g=runtime: addr = runtime: base = runtime: gp: gp=runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod which can Creates a new access token that duplicates one already in existence"[Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin], Observed api string:"CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Square runtime stack: bad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapnewmHandoff.lockno route to hostnon-Go function object is remotereflect mismatchremote I/O errorruntime: g: g=runtime: addr = runtime: base = runtime: gp: gp=runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod which can Creates a new access token that duplicates an existing token"[Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin] Observed api string:"Variation_SelectorWriteProcessMemory[controller reset]adaptivestackstartbad manualFreeListbufio: buffer fullconnection refusedfaketimeState.lockfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errormultihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintruntime.semacreateruntime.semawakeupruntime: npages = runtime: range = {runtime: textAddr streams pipe errorsystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC work not flushedGetCurrentProcessIdGetSystemDirectoryWGetTokenInformationHaiti Standard TimeIDS_Binary_OperatorIndia Standard TimeKhitan_Small_ScriptKorea Standard TimeLibya Standard TimeMultiByteToWideCharNepal Stan which can Retrieves a specified type of information about an access token"[Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin] Observed api string:"dard TimePattern_White_SpaceRussia Time Zone 10Russia Time Zone 11Samoa Standard TimeSetTokenInformationSudan Standard TimeSyria Standard TimeTokyo Standard TimeTomsk Standard TimeTonga Standard TimeWaitForSingleObjectadjusttimers: bad pbad ABI descriptionbad file descriptorbad kind in runfinqbad notifyList sizebad runtime which can Sets various types of information for a specified access token"[Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]25:T465,Observed api string:"25931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCentral Standard TimeEastern Standard TimeGetProfilesDirectoryWInscriptional_PahlaviLookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNetUserGetLocalGroupsNorfolk Standard TimeOther_Grapheme_ExtendPacific Standard TimeReadDirectoryChangesWRomance Standard TimeRussian Standard TimeSE Asia Standard TimeSaratov Standard TimeYakutsk Standard Timeasync stack too largebad type in compare: block device requiredbufio: negative countcheckdead: runnable gconcurrent map writesdefer on system stackfindrunnable: wrong plink has been severednegative shift amountpackage not installedpanic on system stackpreempt at unknown pcread-only file systemreflect.Value.Complexreflect.Value.Pointerreflect.Value.SetUintreleasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work." [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]26:Tb95,Observed api string:"profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed} sched={pc: but progSize nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit 1907348632812595367431640625CertCloseStoreCreateProcessWCryptGenRandomEnumPageFilesWFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWMB; allocated NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such devicepollCache.lockprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriod" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin] Observed api string:"OpenThreadTokenOther_LowercaseOther_UppercaseProcess32FirstWPsalter_PahlaviRegCreateKeyExWRegDeleteValueWUnmapViewOfFile] morebuf={pc:advertise errorasyncpreemptoffdouble scavengeforce gc (idle)invalid argSizekey has expiredmalloc deadlockmisaligned maskmissing mcache?ms: gomaxprocs=negative offsetnetwork is downno medium foundno such processpreempt SPWRITErecovery failedruntime error: runtime.gopanicruntime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding ptraceback stuck already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin] Observed api string:"West Asia Standard TimeWest Bank Standard Time" missing CPU support bytes.Buffer: too largechan receive (nil chan)close of closed channeldevice or resource busyfatal: morestack on g0 garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = left over markroot jobsmakechan: bad alignmentmissing type in runfinqnanotime returning zerono space left on deviceoperation not permittedoperation not supportedpanic during preemptoffprocresize: invalid argreflect.Value.Interfacereflect.Value.NumMethodreflect.methodValueCallruntime: internal errorruntime: invalid type runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding locksshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (work.nwait > work.nproc116415321826934814453125582076609134674072265625Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSy" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]27:T4bd,Heuristic match: "*runtime.name" Heuristic match: "__x86.get_pc_thunk.ax" Heuristic match: "__x86.get_pc_thunk.cx" Heuristic match: "__x86.get_pc_thunk.si" Heuristic match: "runtime.(*functype).in" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*pollDesc).info" Heuristic match: "runtime.name.name" Heuristic match: "internal/reflectlite.name.name" Heuristic match: "sync.(*Once).Do" Heuristic match: "reflect.(*funcType).in" Heuristic match: "reflect.name.name" Heuristic match: "reflect.flag.ro" Heuristic match: "reflect.Value.Int" Pattern match: "type..eq.io/fs.PathError" Pattern match: "l.TqUc/XY" Heuristic match: "OM \=.NL" Heuristic match: "D/' C1.bo" Pattern match: "crl.comodoca.com/AAACertificateServices.crl04" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "https://sectigo.com/CPS0" Pattern match: "crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y" Pattern match: "crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#" Pattern match: "http://ocsp.sectigo.com0" Pattern match: "http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0" Pattern match: "http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#" Heuristic match: "%.wf"28:T802,"start of mark phasecipher: NewGCM requires 128-bit block ciphercompileCallback: float results not supportedgcmarknewobject called while doing checkmarkmult128bitPow10: power of 10 is out of rangeno P available, write barriers are forbiddennon-zero segment_selector size not supportedoptional header has unexpected Magic of 0x%xout of memory allocating heap arena metadatareflect: funcLayout with interface receiver unsafe.Slice: ptr is nil and len is not zeroSOFTWARE\Microsoft\Windows\CurrentVersion\Runbufio.Scanner: Read returned impossible countcannot send after transport endpoint shutdownexitsyscall: syscall frame is no longer validheapBitsSetType: called with non-pointer typeoffset %d is before the start of string tableproduced a trigger greater than the heap goalreflect: internal error: invalid method indexruntime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state as before?tried to run scavenger f" "start of mark phasecipher: NewGCM requires 128-bit block ciphercompileCallback: float results not supportedgcmarknewobject called while doing checkmarkmult128bitPow10: power of 10 is out of rangeno P available, write barriers are forbiddennon-zero segment_selector size not supportedoptional header has unexpected Magic of 0x%xout of memory allocating heap arena metadatareflect: funcLayout with interface receiver unsafe.Slice: ptr is nil and len is not zeroSOFTWARE\Microsoft\Windows\CurrentVersion\Runbufio.Scanner: Read returned impossible countcannot send after transport endpoint shutdownexitsyscall: syscall frame is no longer validheapBitsSetType: called with non-pointer typeoffset %d is before the start of string tableproduced a trigger greater than the heap goalreflect: internal error: invalid method indexruntime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state as before?tried to run scavenger"29:T92c,Observed api string:"profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed} sched={pc: but progSize nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit 1907348632812595367431640625CertCloseStoreCreateProcessWCryptGenRandomEnumPageFilesWFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWMB; allocated NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such devicepollCache.lockprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriod which can Retrieves information about a particular user account on a server"[Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin] Observed api string:"25931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus Standard TimeCentral Standard TimeEastern Standard TimeGetProfilesDirectoryWInscriptional_PahlaviLookupPrivilegeValueWMagadan Standard TimeMorocco Standard TimeMyanmar Standard TimeNamibia Standard TimeNetGetJoinInformationNetUserGetLocalGroupsNorfolk Standard TimeOther_Grapheme_ExtendPacific Standard TimeReadDirectoryChangesWRomance Standard TimeRussian Standard TimeSE Asia Standard TimeSaratov Standard TimeYakutsk Standard Timeasync stack too largebad type in compare: block device requiredbufio: negative countcheckdead: runnable gconcurrent map writesdefer on system stackfindrunnable: wrong plink has been severednegative shift amountpackage not installedpanic on system stackpreempt at unknown pcread-only file systemreflect.Value.Complexreflect.Value.Pointerreflect.Value.SetUintreleasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work. which can Retrieves a list of local groups to which a specified user belongs"[Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]2a:T2c0c,"openDefer" (Indicator: "open") "selectDone" (Indicator: "select") "GetFileType" (Indicator: "GetFileType") "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle") "s <== at fp= is lr: of on pc= sp: sp=) = ) m=+Inf-Inf3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTChamDashEESTGOGCLEAFLisuMiaoModiNZDTNZSTNewaSASTThai m=] = ] n=allgallpavx2basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeadermsfilefuncidleint8itabkindopenpipereadrootsbrkseeksse3tcp4trueudp4uint ... MB, and got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-0930.text1562578125AdlamBamumBatakBuhidDograErrorGreekKhmerLatinLimbuNushuOghamOriyaOsageRunicSTermTakriTamil] = (arrayclosedeferfalsefaultgFreegcinggscanhchaninit int16int32int64mheapntohspanicscav schedsleepslicesse41sse42ssse3sudogsweeptraceuint8usage B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...) , i = , not 390625<-chanArabicBrahmiCarianChakmaCommonCopticFormatGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLycianLydianRejangSCHED StringSyriacTai_LeTangutTeluguThaanaUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11WanchoYezidi[]byte" (Indicator: "bind") "chan<-efencelistenobjectpopcntrdtscpreadatselectsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitKannadaMakasarMandaicMarchenMultaniMyanmarOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaUNKNOWNWSARecvWSASendtypes value=connectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status 48828125AcceptExArmenianBalineseBopomofoBugineseCancelIoCherokeeCyrillicDuployanEthiopicExtenderGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniOl_ChikiParseIntPhags_PaReadFileTagbanwaTai_ThamTai_VietTifinaghUgariticWSAIoctl[signal stack=[cgocheckcs deadlockeax eb" (Indicator: "connect") "p ebx ecx edi edx eflags eip esi esp fs gs no anodeparsing pollDescreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.traceBuftrigger=unknown(wsaioctl (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA (MISSING)(unknown), newval=, oldval=, size = , tail = 244140625: status=Bassa_VahBhaiksukiCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyreneParseUintSamaritanSundaneseWSASendToWindowsNTWriteFileatomicor8bad indirchan sendcomplex64copystackctxt != 0debugLockfuncargs(hchanLeafinittraceinterfaceinvalid nmSpanDeadmSpanFreentdll.dllpanicwaitpclmulqdqpreemptedprofBlockpsapi.dllrecover: reflect: scavtracestackpooltracebackwbufSpans} stack=[ MB goal, flushGen gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= tar" (Indicator: "FindClose") "getpc= throwing= until pc=%!(NOVERB)(BADINDEX), bound = , limit = /dev/stdin12207031256103515625Bad varintCancelIoExChorasmianCreatePipeDeprecatedDevanagariDnsQuery_WException GC forced GOMAXPROCSGOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockoptgoroutine invalidptrmSpanInUsenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptstackLarget.Kind == ticks.locktracefree(tracegc() unixpacketunknown pcws2_32.dll of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC), elemsize=, npages = /dev/stderr/dev/stdout30517578125: frame.sp=CloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeIdeographicMedefaidrinMoveFileExWNa" (Indicator: "CloseHandle") "ndinagariNetShareAddNetShareDelNew_Tai_LueOld_PersianOld_SogdianOpenProcessPau_Cin_HauRegCloseKeySetFileTimeSignWritingSoft_DottedVirtualLockWSARecvFromWarang_CitiWhite_SpaceassistQueuebad addressbad argSizebad m valuebad messagebad timedivbroken pipecgocall nilclobberfreeclosesocketcreated by crypt32.dllfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgetpeernamegetsocknamei/o timeoutmSpanManualmethodargs(minTrigger=mswsock.dllnetpollInitreflectOffsruntime: P runtime: g runtime: p scheddetailsecur32.dllshell32.dllshort writetracealloc(unreachableuserenv.dll B (" (Indicator: "closesocket") "goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1= wbuf2=%!(BADWIDTH)) p->status=, cons/mark -byte limit 152587890625762939453125Bidi_ControlErrUnknownPCGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLittleEndianLoadLibraryWMeetei_MayekPahawh_HmongReadConsoleWResumeThreadRevertToSelfSetEndOfFileSora_SompengSyloti_NagriTransmitFileUnlockFileExVirtualQueryabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivedumping heapend tracegc entersyscallgcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollableraceFiniLockreleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode != sweepge" (Indicator: "GetConsoleCP") "n MB globals, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWVirtualUnlockWriteConsoleWadvapi32.dll" (Indicator: "FindNextFileW") "bad flushGen bad map statedouble unlockexchange fullfatal error: gethostbynamegetservbynameinvalid base kernel32.dll" (Indicator: "gethostbyname") "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed} sched={pc: but progSize nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit 1907348632812595367431640625CertCloseStoreCreateProcessWCryptGenRandomEnumPageFilesWFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWMB; allocated NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such devicepollCache.lockprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriod" (Indicator: "CertCloseStore") "too many linkstoo many usersunexpected EOFunknown methodunreachable: unsafe.Pointerwinapi error #work.full != 0 with GC prog 476837158203125ASCII_Hex_DigitCreateHardLinkWDeviceIoControlDuplicateHandleFailed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWHanifi_RohingyaImpersonateSelfLoadLibraryExA" (Indicator: "DeviceIoControl") "LoadLibraryExW" (Indicator: "LoadLibraryExW") "OpenThreadTokenOther_LowercaseOther_UppercaseProcess32FirstWPsalter_PahlaviRegCreateKeyExWRegDeleteValueWUnmapViewOfFile] morebuf={pc:advertise errorasyncpreemptoffdouble scavengeforce gc (idle)invalid argSizekey has expiredmalloc deadlockmisaligned maskmissing mcache?ms: gomaxprocs=negative offsetnetwork is downno medium foundno such processpreempt SPWRITErecovery failedruntime error: runtime.gopanicruntime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding ptraceback stuck already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory" (Indicator: "OpenThreadToken") "CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Square runtime stack: bad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapnewmHandoff.lockno route to hostnon-Go function object is remotereflect mismatchremote I/O errorruntime: g: g=runtime: addr = runtime: base = runtime: gp: gp=runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod" (Indicator: "CreateDirectoryW"), "workbuf is empty spinningthreads= p.searchAddr = 0123456789ABCDEFX0123456789abcdefx1192092895507812559604644775390625: missing method DnsRecordListFreeFLE Standard TimeGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWLookupAccountSidWOld_North_ArabianOld_South_ArabianOther_ID_ContinueReadProcessMemoryRegLoadMUIStringWRtlGetCurrentPeb" (Indicator: "GetCurrentProcess"), "Sentence_TerminalSystemFunction036Unified_IdeographWSAEnumProtocolsWbad TinySizeClassdebugPtrmask.lockentersyscallblockexec format errorg already scannedglobalAlloc.mutexinvalid bit size locked m0 woke upmark - bad statusmarkBits overflowno data availablenotetsleepg on g0permission deniedreflect.Value.Intreflect.Value.Lenreflect: call of runtime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version" (Indicator: "select"), "wrong medium type but memory size because dotdotdot in async preempt to non-Go memory locked to thread298023223876953125Arab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWIran Standard TimeLookupAccountNameWOmsk Standard TimeRFS specific errorRegional_IndicatorRussia Time Zone 3SetFileAttributesWSystemFunction036" (Indicator: "CreateFileMappingW")2b:T64e,Observed api string:"n MB globals, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWVirtualUnlockWriteConsoleWadvapi32.dll" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin] Observed api string:"profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed} sched={pc: but progSize nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit 1907348632812595367431640625CertCloseStoreCreateProcessWCryptGenRandomEnumPageFilesWFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWMB; allocated NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such devicepollCache.lockprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriod" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]2c:T465,Observed api string:"Variation_SelectorWriteProcessMemory[controller reset]adaptivestackstartbad manualFreeListbufio: buffer fullconnection refusedfaketimeState.lockfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errormultihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintruntime.semacreateruntime.semawakeupruntime: npages = runtime: range = {runtime: textAddr streams pipe errorsystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC work not flushedGetCurrentProcessIdGetSystemDirectoryWGetTokenInformationHaiti Standard TimeIDS_Binary_OperatorIndia Standard TimeKhitan_Small_ScriptKorea Standard TimeLibya Standard TimeMultiByteToWideCharNepal Stan" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]2d:Ta0d,"file.exe" wrote bytes "0070a559" to virtual address "0x76A28AA0" (part of module "KERNELBASE.DLL") "file.exe" wrote bytes "2090c5745094c5744092c5742091c5740095c574009bc574b093c574809ac574" to virtual address "0x76A2E1A4" (part of module "KERNELBASE.DLL") "file.exe" wrote bytes "0070a559" to virtual address "0x761C3010" (part of module "WIN32U.DLL") "file.exe" wrote bytes "e97b56a7fa" to virtual address "0x746F5960" ("EnumWindows@USER32.DLL") "file.exe" wrote bytes "0070a559" to virtual address "0x74CA1E98" (part of module "KERNEL32.DLL") "file.exe" wrote bytes "80b9c57470c9c57400cbc57420bbc574" to virtual address "0x76A2E170" (part of module "KERNELBASE.DLL") "file.exe" wrote bytes "77c7b22d" to virtual address "0x7704B350" (part of module "NTDLL.DLL") "file.exe" wrote bytes "e92b1f01ff" to virtual address "0x70147C00" (part of module "APPHELP.DLL") "file.exe" wrote bytes "309fae74f066b174702aad7420a4ae747023ad74003bae741060ae74b05bae7400b0ae74805bae74d081ae74d00dac74" to virtual address "0x76C0E018" (part of module "GDI32.DLL") "file.exe" wrote bytes "d07ec574f082c774a039c474000ec574607bc57450c7c4745086c7746081c774d006c5746080c57450c0c4742029c474f010c5745033c4747032c474103ec474802ac47450cfc774c039c4747039c474d039c4749082c574a07bc574" to virtual address "0x76A2E238" (part of module "KERNELBASE.DLL") "file.exe" wrote bytes "0070a559" to virtual address "0x74764EEC" (part of module "USER32.DLL") "file.exe" wrote bytes "0070a559" to virtual address "0x77049218" ("Wow64Transition@NTDLL.DLL") "file.exe" wrote bytes "1032f57680ecf976208af67600000000" to virtual address "0x761C3000" (part of module "WIN32U.DLL") "file.exe" wrote bytes "e9cbe9a7fa" to virtual address "0x746EBD30" ("GetKeyState@USER32.DLL") "file.exe" wrote bytes "e93bffa7fa" to virtual address "0x746EADF0" ("GetWindowTextW@USER32.DLL") "file.exe" wrote bytes "a0928d02b0928d02b017010080f00600c0020100b0f0060060b20600e0918d02f0918d02" to virtual address "0x7475AC94" (part of module "USER32.DLL") "file.exe" wrote bytes "8075c5745078c574600bc474f074c574b075c5741029c474e074c5741075c574500bc4740075c574" to virtual address "0x76A2E144" (part of module "KERNELBASE.DLL") "file.exe" wrote bytes "5016c574c085c474" to virtual address "0x76A2E184" (part of module "KERNELBASE.DLL") "file.exe" wrote bytes "409bc574c09bc574" to virtual address "0x76A2E1C8" (part of module "KERNELBASE.DLL") "file.exe" wrote bytes "00ebc474f0eac474e00fc574e0eac474900fc57430ebc474b0ebc474f0dbc474700ec57470ebc474d001c574" to virtual address "0x76A2E208" (part of module "KERNELBASE.DLL")2e:T44d,"62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin" file has an entrypoint instructions - "jmp0x45b730,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,movecx, dword ptr [esp + 4],subesp, 0x28,movdword ptr [esp + 0x1c], ebx,movdword ptr [esp + 0x10], ebp,movdword ptr [esp + 0x14], esi,movdword ptr [esp + 0x18], edi,movesi, eax,movedx, dword ptr fs:[0x14],cmpedx, 0,jne0x45d9dc,moveax, 0,jmp0x45da40,movedx, dword ptr [edx],cmpedx, 0,jne0x45d9ec,call0x45dae0,movdword ptr [esp + 0x20], edx,movdword ptr [esp + 0x24], esp,movebx, dword ptr [edx + 0x18],movebx, dword ptr [ebx],cmpedx, ebx,je0x45da15,movebp, dword ptr fs:[0x14]," "conhost.exe.bin" file has an entrypoint instructions - "subrsp, 0x28,call0x140001b00,addrsp, 0x28,jmp0x14000167c,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,int3,nopword ptr [rax + rax],cmprcx, qword ptr [rip + 0x3819],bnd jne0x14000183c,rolrcx, 0x10,testcx, 0xffff,bnd jne0x140001838,bnd ret,rorrcx, 0x10,jmp0x140001f20,int3,int3,int3,subrsp, 0x28,call0x140002224,testeax, eax,je0x140001872,"18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":null,"file_activity":{"dropped_files":[],"extracted_files":[{"name":"conhost.exe.bin","sha256":"4668bb2223ffb983a5f1273b9e3d9fa2c5ce4a0f1fb18ca5c1b285762020073c","sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[]},"mutex_activity":{"mutex_created":[]},"network_activity":{"contacted_hosts":[],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["msvcrt.dll","oleaut32.dll","ole32.dll","KernelBase.dll","imm32.dll","user32.dll","cryptbase.dll","ws2_32.dll","ntdll.dll","powrprof.dll","cfgmgr32.dll","winmmbase.dll","advapi32.dll","wow64win.dll","win32u.dll","msvcp_win.dll","combase.dll","wow64cpu.dll","apphelp.dll","wow64.dll","gdi32full.dll","rpcrt4.dll","winmm.dll","sechost.dll","kernel32.dll","ucrtbase.dll","sspicli.dll","bcryptprimitives.dll","fltLib.dll","gdi32.dll"],"processes":[{"command_line":"","icon":"$22","name":"file.exe","normalized_path":"C:\\file.exe","pid":7576,"ppid":0,"sha256":"62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e","uid":"00000000-00007576"},{"command_line":"","name":"notepad.exe","normalized_path":"%WINDIR%\\SysWOW64\\notepad.exe","parent_uid":"00000000-00007576","pid":7472,"ppid":7576,"sha256":"f60e23e0d5cbd44794977c641d07228f8c7a9255f469a1fe9b2ae4c4cc009edc","uid":"00000000-00007472"},{"command_line":"-u -p 7576 -s 516","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007576","pid":6148,"ppid":7576,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00006148"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},"registry_activity":{"keys_created":[],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Extracted Files","Sample Crashed"],"sandbox_reports":[{"analysis_start_time":"2023-02-04T06:15:36+00:00","environment_description":"Windows 10 64 bit","environment_id":160,"id":"63ddf8056d10967b091287e7","indicators_count":{"informative":46,"malicious":6,"suspicious":18},"is_in_unified_schema":true,"malware_family":"AGEN.1248181","state":"SUCCESS","submit_name":"file.exe","tags":["Extracted Files","Sample Crashed"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":0,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":1,"files_deleted_count":0,"files_written_count":0,"http_requests_count":0,"imported_dlls_count":30,"injected_processes_count":0,"mutex_created_count":0,"process_count":3,"registry_keys_created_count":0,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"script_calls_count":0,"spawned_processes_count":3}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Win/malicious_confidence_100%"}]},"av_detections":{"engines":{}},"incidents":[{"details":[{"detail":"Found a Wine emulator related string"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"details_count":2,"name":"Evasive","sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"details":[{"detail":"Hooks API calls"}],"details_count":1,"name":"Spyware","sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Installs hooks/patches the running process"}],"details_count":3,"name":"Persistence","sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"details":[{"detail":"Queries process information"},{"detail":"Reads the windows installation language"}],"details_count":2,"name":"Fingerprint","sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Discovery","technique":"Security Software Discovery"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Discovery","technique":"Local Account"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credential API Hooking"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder"},{"attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Create Process with Token"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to write data into process memory (API string)"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Hollowing"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"}],"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"}],"rule_matches":{},"sandbox_signatures":[{"category":"General","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin)","id":"static-79","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to dynamically determine API calls","origin":"Static Parser","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"\"62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin\" has an writable section named \".data\"\n \"62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin\" has an writable section named \".idata\"\n \"conhost.exe.bin\" has an writable section named \".data\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"$23","id":"string-170","level":"informative","name":"Possibly use system binaries","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed API string:\"GetModuleFileName\" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"System Security","description":"\"EnumWindows@USER32.DLL\" in \"file.exe\"\n \"Wow64Transition@NTDLL.DLL\" in \"file.exe\"\n \"GetKeyState@USER32.DLL\" in \"file.exe\"\n \"GetWindowTextW@USER32.DLL\" in \"file.exe\"\n \"GetActiveWindow@USER32.DLL\" in \"file.exe\"\n \"ExitWindowsEx@USER32.DLL\" in \"file.exe\"\n \"GetAsyncKeyState@USER32.DLL\" in \"file.exe\"\n \"GetWindowTextA@USER32.DLL\" in \"file.exe\"\n \"GetForegroundWindow@USER32.DLL\" in \"file.exe\"","id":"hooks-0","level":"suspicious","mitre_attack_id":"T1056.004","name":"Hooks API calls","origin":"Hook Detection","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00007576)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed API string:\"GetStartupInfo\" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"\"Go build ID: \"j7pRfHRXNMxtD2fbq_rZ/XUMsLzwCw0GMfZcfAuPL/j9k8fAmMg14Z1UfDo1hl/P0or25FrdqdGKJbraPWr\"\" (Indicator: \"Go build ID: \"j7pRfHRXNMxtD2fbq_rZ/XUMsLzwCw0GMfZcfAuPL/j9k8fAmMg14Z1UfDo1hl/P0or25FrdqdGKJbraPWr\")\" in Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin","id":"string-74","level":"informative","name":"Possibly references Golang binary related string","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"GetSystemInfo\n LoadLibraryW\n LoadLibraryA\n GetProcAddress\n GetThreadContext\n CreateThread\n WriteFile\n GetSystemDirectoryA\n CreateFileA\n VirtualAlloc\n IsDebuggerPresent\n UnhandledExceptionFilter\n LoadLibraryExW\n GetModuleHandleW\n GetCommandLineW\n TerminateProcess\n GetStartupInfoW","id":"static-1","level":"suspicious","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"\"file.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\SysWOW64\\notepad.exe\" - (UID: 00000000-00007576)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed api string:\"too many linkstoo many usersunexpected EOFunknown methodunreachable: unsafe.Pointerwinapi error #work.full != 0 with GC prog\n476837158203125ASCII_Hex_DigitCreateHardLinkWDeviceIoControlDuplicateHandleFailed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWHanifi_RohingyaImpersonateSelfLoadLibraryExA\" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]","id":"string-118","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to query network adapter information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"System Security","description":"$24","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"Report process \"WerFault.exe\" was created by \"file.exe\"","id":"target-2","level":"informative","name":"An application crash occurred","origin":"Monitored Target","sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"Raw size of \".data\" is \"0x4e1000\" greater than 0x100000","id":"static-125","level":"informative","name":"PE file has a big raw size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","id":"registry-25","level":"informative","mitre_attack_id":"T1012","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"The input sample is signed with a certificate issued by \"CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB\" (SHA1: 28:F9:A8:E7:60:1F:53:38:BF:6E:19:41:51:A7:18:60:8C:01:24:A8; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB\" (SHA1: 0B:C5:E7:67:73:D2:E4:4F:C9:90:3D:4D:FE:FE:45:15:53:BB:EC:4A; see report for more information)","id":"certificate-0","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"cpuid at 00000000-00007576-46987-624-00DF1D80","id":"stream-13","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to query CPU information","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"file.exe\" wrote 4024 bytes to a remote process \"%WINDIR%\\SysWOW64\\notepad.exe\" (Handle: 508)\n \"file.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\SysWOW64\\notepad.exe\" (Handle: 508)\n \"file.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\SysWOW64\\notepad.exe\" (Handle: 508)","id":"api-0","level":"malicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"Antivirus vendors marked dropped file \"conhost.exe.bin\" as clean (type is \"PE32+ executable (GUI) x86-64 for MS Windows\")","id":"binary-16","level":"informative","name":"Drops files marked as clean","origin":"Binary File","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed api string:\"CreateDirectoryWDnsNameCompare_WDuplicateTokenExFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value \"GetComputerNameWGetCurrentThreadGetFullPathNameWGetLongPathNameWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRegQueryInfoKeyWRegQueryValueExWRemoveDirectoryWSetFilePointerExTerminateProcessZanabazar_Square\nruntime stack:\nbad g transitionbad special kindbad summary databad symbol tablecastogscanstatusgc: unswept spangcshrinkstackoffinteger overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapnewmHandoff.lockno route to hostnon-Go function\nobject is remotereflect mismatchremote I/O errorruntime: g: g=runtime: addr = runtime: base = runtime: gp: gp=runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*timeBeginPeriod\" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]","id":"string-122","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Observed api string:\"SetUnhandledExceptionFilter\" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"notepad.exe\" (UID: 00000000-00007472)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7576 -s 516\" (UID: 00000000-00006148)","id":"target-25","level":"informative","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","id":"network-54","level":"informative","mitre_attack_id":"T1573","name":"Making HTTPS connections using secure TLS/SSL version","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"System Security","description":"$25","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to enable or disable privileges in the specified access token (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"Pe file has overlay in 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin","id":"static-131","level":"informative","name":"PE file contains data exceeding the last FAT sector (overlay)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"Virtual size of \".data\" is \"0x50c100\" greater than 0x100000","id":"static-124","level":"informative","name":"PE file has a big virtual size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"notepad.exe\" (UID: 00000000-00007472)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7576 -s 516\" (UID: 00000000-00006148)","id":"target-103","level":"informative","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$26","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate processes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin\" was detected as \"tElock v1.0 (private) -> tE!\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"The entire certificate chain of the input sample was validated successfully.","id":"certificate-2","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a valid certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Network Related","description":"$27","id":"string-3","level":"informative","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Network Related","description":"\"https://sectigo.com/CPS0\" (Indicator: \"https://\")","id":"string-98","level":"informative","mitre_attack_id":"T1573","name":"Possibly tries to communicate over SSL connection (HTTPS)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed api string:\"eflect.Value>Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeLogical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeRtlGetNtVersionNumbers\" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]","id":"string-107","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host's architecture (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"External Systems","description":"No specific details available","id":"avtest-5","level":"malicious","name":"Sample was identified as malicious by a trusted Antivirus engine","origin":"External System","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"External Systems","description":"13/70 Antivirus vendors marked sample as malicious (18% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"\"conhost.exe.bin\" has resource with unusual entropy \"RT_ICON:7.85051980666\"","id":"static-92","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file has unusual entropy resources","origin":"Static Parser","relevance":5,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"file.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\SysWOW64\\notepad.exe\" - (UID: 00000000-00007576)","id":"api-129","level":"malicious","mitre_attack_id":"T1055.012","name":"Creates a process in suspended mode (likely for process injection)","origin":"API Call","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"$28","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"Sentence_TerminalSystemFunction036Unified_IdeographWSAEnumProtocolsWbad TinySizeClassdebugPtrmask.lockentersyscallblockexec format errorg already scannedglobalAlloc.mutexinvalid bit size locked m0 woke upmark - bad statusmarkBits overflowno data availablenotetsleepg on g0permission deniedreflect.Value.Intreflect.Value.Lenreflect: call of runtime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spanthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version\" (Indicator: \"wine_get_version\"; File: \"62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin\")","id":"string-62","level":"malicious","name":"Found a Wine emulator related string","origin":"File/Memory","relevance":2,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (D)","id":"avtest-8","level":"malicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","origin":"External System","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"External Systems","description":"13/70 Antivirus vendors marked sample as malicious (18% detection rate)","id":"avtest-3","level":"malicious","name":"Sample was identified as malicious by a large number of Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Network Related","description":"$29","id":"string-112","level":"informative","mitre_attack_id":"T1087.001","name":"Contains ability to retrieve information about user accounts on a server (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"System Security","description":"Observed API string:\"CreateProcessAsUser\" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]","id":"string-168","level":"informative","mitre_attack_id":"T1134.002","name":"Contains ability to create process with token (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"file.exe\" queried SystemProcessInformation at 00000000-00007576-00000036-747423\n \"file.exe\" queried SystemProcessInformation at 00000000-00007576-00000036-748558","id":"api-9","level":"suspicious","mitre_attack_id":"T1057","name":"Queries process information","origin":"API Call","relevance":4,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"conhost.exe.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: 00000000-00007576]","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin\" claims program is from Thu Jan 1 00:00:00 1970","id":"static-3","level":"suspicious","name":"Timestamp in PE header is very old or in the future","origin":"Static Parser","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"$2a","id":"string-101","level":"informative","name":"Found API related strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"Found VM detection artifact \"RDTSCP trick\" in \"62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin\" (Offset: 377081)","id":"binary-26","level":"informative","mitre_attack_id":"T1497","name":"The input sample possibly contains the RDTSCP instruction","origin":"Binary File","relevance":5,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2b","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"file.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINDOWSNT\"; Value: \"%WINDIR%\\System32\\conhost.exe C:\\file.exe\")","id":"registry-0","level":"suspicious","mitre_attack_id":"T1547.001","name":"Modifies auto-execute functionality by setting/creating a value in the registry","origin":"Registry Access","relevance":8,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"conhost.exe.bin\" claimed CRC 80723 while the actual is CRC 6534163","id":"static-0","level":"suspicious","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$2c","id":"string-92","level":"informative","mitre_attack_id":"T1055.012","name":"Contains ability to write data into process memory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"\"conhost.exe.bin\" has high imagebase \"0x140000000\"","id":"static-93","level":"informative","name":"PE file has a high image base","origin":"Static Parser","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"Process \"notepad.exe\" (UID: 00000000-00007472) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"notepad.exe\" (UID: 00000000-00007472) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"WerFault.exe\" (UID: 00000000-00006148) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"WerFault.exe\" (UID: 00000000-00006148) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","id":"target-67","level":"informative","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"file.exe\" trying to access non-existent file \"%WINDIR%\\System32\\WOW64LOG.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files","origin":"API Call","relevance":3,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00007576)","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"Observed API string:\"ResumeThread\" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]\n Observed API string:\"OpenThread\" [Source: 62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin]","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to modify processes thread functionality (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"\"62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e.bin\" has an executable section named \".text\"\n \"conhost.exe.bin\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"conhost.exe.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: 00000000-00007576]","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":".data with unusual entropies 7.99460843024","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file has unusual entropy sections","origin":"Static Parser","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"rdtscp at 00000000-00007576-46987-139-00E4CCF0","id":"stream-6","level":"suspicious","name":"Contains ability to measure performance","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$2d","id":"hooks-8","level":"suspicious","mitre_attack_id":"T1056.004","name":"Installs hooks/patches the running process","origin":"Hook Detection","relevance":10,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"file.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00007576)","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]},{"category":"General","description":"$2e","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","relevance":1,"sources":[{"report_id":"63ddf8056d10967b091287e7","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"mitre_attacks":{"total":23},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":46,"malicious_count":6,"suspicious_count":13,"total":65}},"summary":{"score":100,"tags":null,"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"file.exe","file_size":6500976,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"9cbefe68f395e67356e2a5d8d1b285c0","md5":"942263313e05915cb53cfdb38d5c32b5","sha1":"137221430dc73e5e1fc6d69ff1f137c4f0fb7171","sha256":"62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e","sha512":"30172400b0aeb6166a0cc4af982b9bde6e71d21ae330c6207d04d852e1d7cd65fc49ec95504c310de6a801d1f2ed6d392dfe99da4bae37fa61bc19823f00c229","ssdeep":"98304:F9ESHkkBC/0Dh1pItsNaY1eq0m0bsCuWPFbmTbow9PdMr6SAdB4e4JJmC2+dh1uy:/EiOKh1paJ2qsgFZwluZAdiegmA/F53R","ssdeep_chunks":["98304:F9ESHkk","98304:9ESHkkB","98304:ESHkkBC","98304:SHkkBC/","98304:HkkBC/0","98304:kkBC/0D","98304:kBC/0Dh","98304:BC/0Dh1","98304:C/0Dh1p","98304:/0Dh1pI","98304:0Dh1pIt","98304:Dh1pIts","98304:h1pItsN","98304:1pItsNa","98304:pItsNaY","98304:ItsNaY1","98304:tsNaY1e","98304:sNaY1eq","98304:NaY1eq0","98304:aY1eq0m","98304:Y1eq0m0","98304:1eq0m0b","98304:eq0m0bs","98304:q0m0bsC","98304:0m0bsCu","98304:m0bsCuW","98304:0bsCuWP","98304:bsCuWPF","98304:sCuWPFb","98304:CuWPFbm","98304:uWPFbmT","98304:WPFbmTb","98304:PFbmTbo","98304:FbmTbow","98304:bmTbow9","98304:mTbow9P","98304:Tbow9Pd","98304:bow9PdM","98304:ow9PdMr","98304:w9PdMr6","98304:9PdMr6S","98304:PdMr6SA","98304:dMr6SAd","98304:Mr6SAdB","98304:r6SAdB4","98304:6SAdB4e","98304:SAdB4e4","98304:AdB4e4J","98304:dB4e4JJ","98304:B4e4JJm","98304:4e4JJmC","98304:e4JJmC2","98304:4JJmC2+","98304:JJmC2+d","98304:JmC2+dh","98304:mC2+dh1","98304:C2+dh1u","98304:2+dh1uy","196608:F9ESHkk","196608:9ESHkkB","196608:ESHkkBC","196608:SHkkBC/","196608:HkkBC/0","196608:kkBC/0D","196608:kBC/0Dh","196608:BC/0Dh1","196608:C/0Dh1p","196608:/0Dh1pI","196608:0Dh1pIt","196608:Dh1pIts","196608:h1pItsN","196608:1pItsNa","196608:pItsNaY","196608:ItsNaY1","196608:tsNaY1e","196608:sNaY1eq","196608:NaY1eq0","196608:aY1eq0m","196608:Y1eq0m0","196608:1eq0m0b","196608:eq0m0bs","196608:q0m0bsC","196608:0m0bsCu","196608:m0bsCuW","196608:0bsCuWP","196608:bsCuWPF","196608:sCuWPFb","196608:CuWPFbm","196608:uWPFbmT","196608:WPFbmTb","196608:PFbmTbo","196608:FbmTbow","196608:bmTbow9","196608:mTbow9P","196608:Tbow9Pd","196608:bow9PdM","196608:ow9PdMr","196608:w9PdMr6","196608:9PdMr6S","196608:PdMr6SA","196608:dMr6SAd","196608:Mr6SAdB","196608:r6SAdB4","196608:6SAdB4e","196608:SAdB4e4","196608:AdB4e4J","196608:dB4e4JJ","196608:B4e4JJm","196608:4e4JJmC","196608:e4JJmC2","196608:4JJmC2+","196608:JJmC2+d","196608:JmC2+dh","196608:mC2+dh1","196608:C2+dh1u","196608:2+dh1uy","98304:/EiOKh1","98304:EiOKh1p","98304:iOKh1pa","98304:OKh1paJ","98304:Kh1paJ2","98304:h1paJ2q","98304:1paJ2qs","98304:paJ2qsg","98304:aJ2qsgF","98304:J2qsgFZ","98304:2qsgFZw","98304:qsgFZwl","98304:sgFZwlu","98304:gFZwluZ","98304:FZwluZA","98304:ZwluZAd","98304:wluZAdi","98304:luZAdie","98304:uZAdieg","98304:ZAdiegm","98304:AdiegmA","98304:diegmA/","98304:iegmA/F","98304:egmA/F5","98304:gmA/F53","98304:mA/F53R"]},"submissions":{"first_seen":1675484544000,"last_multi_scan":1677210629000,"last_seen":1677210629000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["63ddf8056d10967b091287e7"]},"schema_version":"1.0.9","sha256":"62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e","threat_score":100,"unified_at":"2026-09-16T18:35:20.295Z","unified_at_epoch_ms":1789583720295,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 62fb38640d60… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 62fb38640d60…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 62fb38640d60… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 62fb38640d60…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/62fb38640d60c70e8701cc74ebdfc7bf75b4e0274f0daa778ddef889abd3050e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 62fb38640d60… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 62fb38640d60…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]