26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 6ab011bf4159… — Score 82/100 — Hybrid Analysis","description":"Malicious verdict for sample 6ab011bf4159…. Malware family: Win/malicious_confidence_70%. Threat score 82/100. 3/27 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a"],"about":{"@type":"SoftwareApplication","name":"downloadlink.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a","additionalType":"Malicious sample"},"threatScore":82,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T584,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp")28:T6a2,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp")29:T7bf,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp, 00000000-00007768.00000000.191991.003EB000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp, 00000000-00007768.00000000.191991.003EB000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007768.00000000.191991.003EB000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp")2a:T7d82,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerslevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method span.base()=bad flushGen , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext f" (Indicator: "CertOpenStore"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "ile busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CertCloseStore"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "ile busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CryptGenRandom"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitwait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedbad kind in runfinqmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handl" (Indicator: "CertOpenSystemStoreW"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handl" (Indicator: "CryptAcquireContextW"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanchan receive (synctest)makechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; s" (Indicator: "CertGetCertificateChain"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "wept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowunexpected syncgroup setdouble traceGCSweepStartb" (Indicator: "CertFreeCertificateChain"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative" (Indicator: "CertFreeCertificateContext"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin"), Found api reference "nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorychannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unex" (Indicator: "CertCreateCertificateContext"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin"), Found api reference "ut of rangereflect: Elem of invalid type sync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usab" (Indicator: "CertAddCertificateContextToStore"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "ut of rangereflect: Elem of invalid type sync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usab" (Indicator: "CertVerifyCertificateChainPolicy"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerslevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method span.base()=bad flushGen not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext" (Indicator: "CertOpenStore"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file hand" (Indicator: "CertOpenSystemStoreW"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file hand" (Indicator: "CryptAcquireContextW"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanchan receive (synctest)makechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep;" (Indicator: "CertGetCertificateChain"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "wept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowunexpected syncgroup setdouble traceGCSweepStart" (Indicator: "CertFreeCertificateChain"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negativ" (Indicator: "CertFreeCertificateContext"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep une" (Indicator: "CertCreateCertificateContext"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin"), Found api reference "ut of rangereflect: Elem of invalid type sync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usa" (Indicator: "CertAddCertificateContextToStore"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found api reference "ut of rangereflect: Elem of invalid type sync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usa" (Indicator: "CertVerifyCertificateChainPolicy"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin"), Found api reference "runtime: sp=abi mismatchwrong timerslevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method span.base()=bad flushGen not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}" (Indicator: "CertOpenStore"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp") Found api reference ", locked to threadruntime.semacreateruntime.semawakeupbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitwait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedbad kind in runfinqmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp") Found api reference "exit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp, 00000000-00007768.00000000.191991.A2090000.00000004.mdmp")2b:T41d,Contains base64 string in header "POST" in header "POST /c14fbedecd404e0eba6c.php HTTP/1.1Content-Type: application/jsonHost: 45.131.214.233Content-Length: 128Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /c14fbedecd404e0eba6c.php HTTP/1.1Content-Type: application/jsonHost: 45.131.214.233Content-Length: 128Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /c14fbedecd404e0eba6c.php HTTP/1.1Content-Type: application/jsonHost: 45.131.214.233Content-Length: 128Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /c14fbedecd404e0eba6c.php HTTP/1.1Content-Type: application/jsonHost: 45.131.214.233Content-Length: 128Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /c14fbedecd404e0eba6c.php HTTP/1.1Content-Type: application/jsonHost: 45.131.214.233Content-Length: 128Connection: Keep-AliveCache-Control: no-cache"2c:Tcf3,Found XOR loop in file "sample.bin" at offset 77136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 954306; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 961330; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1037897; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1038281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1044623; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1140313; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1148588; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1204169; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1265688; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1364564; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1444891; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1445593; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1509620; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1518932; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1524212; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1565473; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1905586; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 950843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1043189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1050950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1126953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1342537; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1343046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1475401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1554872; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 159542; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 198983; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 306910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 351704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 377701; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 378397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 379038; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 931553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1038018; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1044893; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1265640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1474220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1553608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1662876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1830084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1924560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1964304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2087948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2114240; code bytes = 80302d:T798d,Found reference to API (Indicator: "AddVectoredContinueHandler"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "SetErrorMode"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "DuplicateHandle"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "GetErrorMode"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "SetEvent"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "GetProcAddress"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "RaiseFailFastException"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "SetWaitableTimer"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "SwitchToThread"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "GetStdHandle"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "CreateEventA"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "ResumeThread"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "GetThreadContext"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "VirtualFree"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "WriteFile"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "WerGetFlags"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "SetThreadContext"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "WerSetFlags"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "VirtualQuery"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "CreateThread"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "SuspendThread"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "TlsAlloc"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "CloseHandle"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "ExitProcess"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp, 00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "RegGetValueA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetConnectW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "HttpOpenRequestW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetCrackUrlW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetSetOptionA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp, 00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp, 00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp, 00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp, 00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp, 00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp, 00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp, 00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp, 00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "CancelIo"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "QueueUserAPC"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "CreateNamedPipeA"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "GetSystemPowerStatus"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "CryptBinaryToStringA"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "ReadDirectoryChangesW"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007768.00000000.191991.A2090000.00000004.mdmp")2e:T675,"Software\Aerofox\FoxmailPreview" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\%s\%08d" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\%s\%08d" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007768.00000000.191991.A2090000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007768.00000000.191991.A2090000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007768.00000000.191991.A2090000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00007768.00000000.191991.A2090000.00000004.mdmp2f:T675,"Software\Aerofox\FoxmailPreview" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\%s\%08d" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\%s\%08d" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00007768.00000000.191991.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007768.00000000.191991.A2090000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007768.00000000.191991.A2090000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00007768.00000000.191991.A2090000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007768.00000000.191991.A2090000.00000004.mdmp30:T6aa,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp, 00000000-00007768.00000000.191991.003EB000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007768.00000000.191991.00230000.00000002.mdmp, 00000000-00007768.00000000.191991.003EB000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007768.00000000.191991.003EB000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007768.00000000.191991.40000000.00000040.mdmp")31:Tad2," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69ba41f89a7b3645b00b44df"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\" \"+lFxQkZY1SkVXFZRA5QXjIpyj3F0o9HDLe6KdXz1VH8qKz5piCNq3cap+u6UasAOeQ+57hjra3ImlMxbFwMlYsa7/ylHdMnx/an7M/iFRp6IMc3sUXPbIu2E3e+Hzg==\" HTTP/1.1 200 OK\nServer: nginx/1.24.0 (Ubuntu)\nDate: Wed\n 18 Mar 2026 06:11:34 GMT\nContent-Type: text/html; charset=UTF-8\nContent-Length: 64\nConnection: keep-alive with response body ==>2B6E6B33555142417869315946774158456339536D6F74696B42356E344D47474F6554664D447134486A786E446D7439696A51376775336E31373745445A413D.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69ba41f89a7b3645b00b44df"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 45.131.214.233 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69ba41f89a7b3645b00b44df"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"69ba41f89a7b3645b00b44df"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"69ba41f89a7b3645b00b44df"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"