26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 735bc2580f39… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample 735bc2580f39…. Malware family: Win/malicious_confidence_90%. Threat score 86/100. 3/28 AV engines flagged this file. 2 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562"],"about":{"@type":"SoftwareApplication","name":"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4f6,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin")28:T40b,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin")29:T5f4,Found reference to "forHKDF" (Indicator: "HKDF"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "HMAC"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to "runtime.useAeshash" (Indicator: "Aes"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to "crypto/internal/fips140deps/cpu.ARM64HasSHA512" (Indicator: "SHA512"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to "crypto/internal/fips140deps/cpu.S390XHasSHA512" (Indicator: "SHA512"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin")2a:T69e,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmunknown sizelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd6" (Indicator: "CertOpenStore"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "4 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625GetTempPath2WModule32NextWRtlGetVersioncrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasize#failfipscastRegDeleteKeyWRegEnumValueWHMAC-SHA2-256file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "4 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625GetTempPath2WModule32NextWRtlGetVersioncrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasize#failfipscastRegDeleteKeyWRegEnumValueWHMAC-SHA2-256file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125reflect.Value.Elemreflect.Value.TypeGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stac" (Indicator: "CryptReleaseContext"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "uresha3: Write after Readdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethodGetSidSubA" (Indicator: "CertGetCertificateChain"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "uthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlock" missing CPU supportexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlock11641532182693481445312558207660" (Indicator: "CertFreeCertificateChain"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GetSidIdentifierAuthorityinconsistent poll.fdMutexGODEBUG: can not enable "hash of unhashable type: ExpandEnvironmentStringsWtesting simulated failureinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper w" (Indicator: "CertFreeCertificateContext"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "aitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleExGC" (Indicator: "CertCreateCertificateContext"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "eap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625reflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages =" (Indicator: "CertAddCertificateContextToStore"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "eap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625reflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages =" (Indicator: "CertVerifyCertificateChainPolicy"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmunknown sizelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd" (Indicator: "CertOpenStore"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125reflect.Value.Elemreflect.Value.TypeGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 sta" (Indicator: "CryptReleaseContext"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "uresha3: Write after Readdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethodGetSidSub" (Indicator: "CertGetCertificateChain"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "uthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlock" missing CPU supportexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlock1164153218269348144531255820766" (Indicator: "CertFreeCertificateChain"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GetSidIdentifierAuthorityinconsistent poll.fdMutexGODEBUG: can not enable "hash of unhashable type: ExpandEnvironmentStringsWtesting simulated failureinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper" (Indicator: "CertFreeCertificateContext"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleExG" (Indicator: "CertCreateCertificateContext"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin")2c:T1853,Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin Observed string: "crypto/internal/fips140/aes" (Indicator: "crypto/internal/fips140/aes") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin Observed string: "crypto/internal/fips140/sha512" (Indicator: "crypto/internal/fips140/sha512") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin Observed string: "253906256938893903907228377647697925567626953125ryuFtoaFixed32 called with negative precMapIter.Key called on exhausted iteratortime: Stop called on uninitialized Timercrypto/cipher: output smaller than input" (Indicator: "253906256938893903907228377647697925567626953125ryuFtoaFixed32 called with negative precMapIter.Key called on exhausted iteratortime: Stop called on uninitialized Timercrypto/cipher: output smaller than input") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin Observed string: "delta-V: runtime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds maximum" (Indicator: "delta-V: runtime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds maximum") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin Observed string: ": reflect: reflect.Value.UnsafePointer on an invalid notinheap pointercrypto/hmac: hash generation function does not produce unique values===" (Indicator: ": reflect: reflect.Value.UnsafePointer on an invalid notinheap pointercrypto/hmac: hash generation function does not produce unique values===") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin Observed string: "): runtime: GetQueuedCompletionStatusEx returned net_op with invalid mode= runtime.Goexit called in a thread that was not created by the Go runtimecrypto/rand: failed to read random data (see https://go.dev/issue/66821): Delta-V" (Indicator: "): runtime: GetQueuedCompletionStatusEx returned net_op with invalid mode= runtime.Goexit called in a thread that was not created by the Go runtimecrypto/rand: failed to read random data (see https://go.dev/issue/66821): Delta-V") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: ": cannot convert slice with length %y to array or pointer to array with length %xNtCreateWaitCompletionPacket exists but NtAssociateWaitCompletionPacket does notcrypto/rand: blocked for 60 seconds waiting to read random data from the kernel" (Indicator: ": cannot convert slice with length %y to array or pointer to array with length %xNtCreateWaitCompletionPacket exists but NtAssociateWaitCompletionPacket does notcrypto/rand: blocked for 60 seconds waiting to read random data from the kernel") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: "crypto/internal/sysrand.fatal" (Indicator: "crypto/internal/sysrand.fatal") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: "crypto/internal/fips140deps/cpu.init" (Indicator: "crypto/internal/fips140deps/cpu.init") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: "crypto/internal/impl.Register" (Indicator: "crypto/internal/impl.Register") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: "type:.eq.crypto/internal/impl.implementation" (Indicator: "type:.eq.crypto/internal/impl.implementation") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: "type:.eq.crypto/internal/fips140/sha256.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha256.Digest") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: "type:.eq.crypto/internal/fips140/sha3.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha3.Digest") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: "crypto/internal/sysrand.warnBlocked" (Indicator: "crypto/internal/sysrand.warnBlocked") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: "crypto/internal/sysrand.Read" (Indicator: "crypto/internal/sysrand.Read") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: "crypto/internal/sysrand.read" (Indicator: "crypto/internal/sysrand.read") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: "crypto/internal/sysrand.Read.deferwrap1" (Indicator: "crypto/internal/sysrand.Read.deferwrap1") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: "crypto/internal/entropy.Depleted" (Indicator: "crypto/internal/entropy.Depleted") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: "crypto/internal/fips140only.init" (Indicator: "crypto/internal/fips140only.init") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin, Observed string: "crypto/sha256.init.0" (Indicator: "crypto/sha256.init.0") in Source: 735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin2d:T10b1,Found XOR loop in file "sample.bin" at offset 92338; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 731908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1167084; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1343881; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1485315; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1583363; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1612547; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1838851; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1909763; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1918467; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1935456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2078723; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2357358; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2725985; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3024148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 97324; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1415868; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488828; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1583292; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1739708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1826748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2102716; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2131644; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2269628; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2311455; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2343772; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2782526; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3103148; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3254802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 188950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226761; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 227121; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 227521; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229683; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 252273; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 272400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 414981; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 415677; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 416318; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 426697; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 772852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1400986; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1416602; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1564314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1671322; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1693338; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1724058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1741978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1810842; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1811610; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1853850; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1879962; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1929882; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1932954; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2566314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2841304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2884224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3135706; code bytes = 80302e:T9f2," [("")) ) +: @s -> PB n=][}]> [ ] 25LlLtLuMn"os g %nilfinptrobj()gc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= GEOF125625intmap\\.\\?\??adxaesshaavxfmanetgcm" (Indicator: "aes"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), file/memory contains long string with (Indicator: "aes"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), file/memory contains long string with (Indicator: "3des"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "runtime.initAlgAES" (Indicator: "aes"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "aeshashbody" (Indicator: "aes"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "crypto/internal/fips140/aes.init" (Indicator: "aes"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "crypto/internal/fips140/aes.KeySizeError.Error" (Indicator: "aes"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "crypto/internal/fips140/aes.newOutlined" (Indicator: "aes"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "crypto/internal/fips140/aes.newOutlined" (Indicator: "aes.new"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin"), Found string "crypto/internal/fips140/aes.(*Block).BlockSize" (Indicator: "aes"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin")3b:T54b,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "Module32Next"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "Process32First"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "Module32First"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin")3c:Taea,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "QueryInformationFile"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "syscall.GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "syscall.GetFileAttributes" (Indicator: "GetFileAttributes"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "syscall.procGetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "syscall.procGetFileAttributesW" (Indicator: "GetFileAttributes"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "os.useGetTempPath2" (Indicator: "GetTempPath"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "internal/syscall/windows.procGetTempPath2W" (Indicator: "GetTempPath"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") Found reference to API "internal/syscall/windows.procNtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin")3d:T6f8,file/memory contains long string with (Indicator: "CopySid"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "IsValidSid"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "GetLengthSid"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "RevertToSelf"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "DuplicateToken"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin")3e:T95a,"g0= pad1= pad2= text= minpc= value= (scan)types : type 19531259765625invaliduintptrChanDir Value>\\\\.\\UNCavx512fruntimeos/execfips140tls3destlssha1AES-CBC; Source: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"crypto/internal/fips140/aes.decryptBlock\" (Indicator: \".decrypt\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockGeneric\" (Indicator: \".decrypt\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockAsm\" (Indicator: \".decrypt\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockAsm.abi0\" (Indicator: \".decrypt\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00006968-00000C2B-666819881\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00006968-00000C2B-666819955\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00006968-00000C2B-666819980\")\n Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00006968-00000C2B-666820002\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00006968-00000C2B-666820032\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00006968-00000C2B-666820054\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.08631","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains possible references to Golang crypto modules\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006968-00000C2B-666666032\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006968-00000C2B-666666032\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")\n Found string \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006968-00000C2B-666556783\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\"\n Found system information discovery API: \"RtlNtStatusToDosError (in long string)\" in file \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\"\n Found system information discovery API: \"internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb\" in file \"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562.bin\" has section name .rdata with entropy \"7.2244885317707395\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a51327390f95bad4b069e9e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"