26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 82b1f5a2bd18… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 82b1f5a2bd18…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 3/26 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de"],"about":{"@type":"SoftwareApplication","name":"82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin","applicationCategory":["peexe","executable"],"identifier":"82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tc94,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003224.00000001.149045.05800000.00000004.mdmp")28:Tdd0,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.05800000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp") Found reference to API "#@QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003224.00000001.149045.05800000.00000004.mdmp") Found reference to API ""@QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003224.00000002.150963.05900000.00000004.mdmp"), Found reference to API ""@GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003224.00000002.150963.05900000.00000004.mdmp")29:Tc3d,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.05800000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.05800000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.05800000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.05800000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp, 00000000-00003224.00000002.150963.0123F000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp, 00000000-00003224.00000002.150963.0123F000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003224.00000002.150963.0123F000.00000002.mdmp")2a:T5db,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035FA000.00000004.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035FA000.00000004.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp")2b:T784,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile" (Indicator: "CertOpenStore"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found api reference "too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found api reference "too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found api reference "rangebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad index, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panicunexpected g status, g->atomicstatus=bad runtime" (Indicator: "CryptReleaseContext"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverableread-only file systemst" (Indicator: "CertOpenSystemStoreW"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverableread-only file systemst" (Indicator: "CryptAcquireContextW"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found api reference "on: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=4656612873077392578125exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad" (Indicator: "CertGetCertificateChain"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found api reference "profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp" (Indicator: "CertFreeCertificateChain"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitnotewakeup - double wakeuppersistentalloc: size == 0failed putFast after drainnegative idle mark workersuse of invalid swe" (Indicator: "CertFreeCertificateContext"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin"), Found api reference "epLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free obj" (Indicator: "CertCreateCertificateContext"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin"), Found api reference "ortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin"), Found api reference "ortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverableread-only file systems" (Indicator: "CertOpenSystemStoreW"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverableread-only file systems" (Indicator: "CryptAcquireContextW"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin"), Found api reference "profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625", missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: m" (Indicator: "CertFreeCertificateChain"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitnotewakeup - double wakeuppersistentalloc: size == 0failed putFast after drainnegative idle mark workersuse of invalid sw" (Indicator: "CertFreeCertificateContext"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free ob" (Indicator: "CertCreateCertificateContext"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin"), Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp 00000000-00003224.00000000.147125.035B0000.00000004.mdmp 00000000-00003224.00000001.149045.00400000.00000040.mdmp 00000000-00003224.00000001.149045.035B0000.00000004.mdmp 00000000-00003224.00000002.150963.00400000.00000040.mdmp 00000000-00003224.00000002.150963.035B0000.00000004.mdmp 00000000-00003224.00000002.150963.05900000.00000004.mdmp 00000000-00003224.00000003.153802.00400000.00000040.mdmp 00000000-00003224.00000003.153802.035B0000.00000004.mdmp"), Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00003224.00000000.147125.035B0000.00000004.mdmp 00000000-00003224.00000001.149045.035B0000.00000004.mdmp 00000000-00003224.00000002.150963.035B0000.00000004.mdmp 00000000-00003224.00000003.153802.035B0000.00000004.mdmp"), Found api reference "CryptBinaryToStringA" (Indicator: "CryptBinaryToStringA"; Source: "00000000-00003224.00000000.147125.035B0000.00000004.mdmp 00000000-00003224.00000001.149045.035B0000.00000004.mdmp 00000000-00003224.00000002.150963.035B0000.00000004.mdmp 00000000-00003224.00000003.153802.035B0000.00000004.mdmp"), Found api reference "runtime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp"), Found api reference " locked to thread synctest bubble runtime.semacreateruntime.semawakeup298023223876953125value out of rangebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad index gp->atomicstatus=marking free object KiB work (eager) [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp"), Found api reference "exit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp") Found api reference "unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp") Found api reference "unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00003224.00000003.153802.26760000.00000004.mdmp")2d:T35f5,Contains base64 string in header "POST" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 140Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 140Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 140Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 140Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 140Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 6100Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 6100Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 6100Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 6100Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 6100Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "233328Connection" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 80408Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 80408Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 80408Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 80408Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 80408Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 102260Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 102260Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 102260Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 102260Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "102260Connection" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 102260Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 102260Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 240612Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 240612Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 240612Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 240612Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "240612Connection" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 240612Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 240612Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "466376Connection" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 128356Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 128356Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 128356Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 128356Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "128356Connection" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 128356Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 128356Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 160Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 160Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 160Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 160Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /364dbdbec4d04dcdabed.php HTTP/1.1Content-Type: application/jsonHost: 130.12.182.13Content-Length: 160Connection: Keep-AliveCache-Control: no-cache"2e:T13d9,Found XOR loop in file "sample.bin" at offset 95500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 113481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 769060; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1075778; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1275935; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1346982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1608541; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1784316; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1841848; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2078767; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2082061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2085607; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2086381; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2089227; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2091417; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2091899; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2092565; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2093329; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2093865; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2094769; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2095189; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2095905; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2097549; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099043; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099475; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2100409; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2112668; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 19326; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 316441; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2066797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2075693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 159400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 159715; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 159759; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 160905; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 161007; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 208421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 261642; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 261945; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 262432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 262750; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 262802; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 265162; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 265214; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 706816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 764384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 822528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1070286; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1098903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1157129; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1209966; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1370478; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1390828; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1683223; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2082022; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2082532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2082924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2083316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2083708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2084602; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2088004; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2089220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2089820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2090728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2096380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2098190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2099004; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2099438; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2100390; code bytes = 80302f:T540,file/memory contains long string with (Indicator: "GetCommandLine"; File: "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003224-00000C2C-1299438209") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003224-00000C2C-1299438241") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.05800000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.05800000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") file/memory contains long string with (Indicator: "GetCommandLine"; Source: "00000000-00003224.00000001.149045.010C6000.00000002.mdmp")30:Tb5f,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.05800000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.05800000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp") Found reference to API ""@GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003224.00000002.150963.05900000.00000004.mdmp"), Found reference to API ""@EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00003224.00000002.150963.05900000.00000004.mdmp")31:T632,Found system information discovery API: "GetSystemInfo" in file "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.05800000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp" Found system information discovery API: ""@GetEnvironmentStringsW" in "00000000-00003224.00000001.149045.05800000.00000004.mdmp"32:Teec,"" (Indicator: "GetDC"; Source: "00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp") Found reference to API "259420614574,892,3181,,CreateCompatibleBitmap,Gdi32.dll,"00:40:02.062",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003224.00000003.153802.0362A000.00000004.mdmp")4e:Ta1c,Found registry query API: "RegOpenKey (in long string)" in file "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin" Found registry query API: "RegQueryValue (in long string)" in file "82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin" Found registry query API: "RegEnumValueA" in "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp" Found registry query API: "RegGetValueA" in "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.05800000.00000004.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.05900000.00000004.mdmp, 00000000-00003224.00000003.153802.00400000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00003224.00000000.147125.00400000.00000040.mdmp, 00000000-00003224.00000001.149045.00400000.00000040.mdmp, 00000000-00003224.00000002.150963.00400000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp" Found registry query API: "RegOpenKey (in long string)" in "00000000-00003224.00000001.149045.010C6000.00000002.mdmp" Found registry query API: "RegQueryValue (in long string)" in "00000000-00003224.00000001.149045.010C6000.00000002.mdmp"4f:T8b1,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69c4e6fe93e75b311b0d3f62"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69c4e6fe93e75b311b0d3f62"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69c4e6fe93e75b311b0d3f62"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; File: \"82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin\")\n Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; Source: \"00000000-00003224.00000002.150963.0123F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69c4e6fe93e75b311b0d3f62"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003224.00000000.147125.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003224.00000001.149045.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003224.00000001.149045.010C6000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003224.00000002.150963.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003224.00000002.150963.05900000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003224.00000003.153802.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69c4e6fe93e75b311b0d3f62"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69c4e6fe93e75b311b0d3f62"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"82b1f5a2bd180d109c64318621db8be78f66bde0e761f8f63d5569fb589df6de.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69c4e6fe93e75b311b0d3f62"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003224-00000C2C-1300421962\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69c4e6fe93e75b311b0d3f62"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69c4e6fe93e75b311b0d3f62"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003224.00000000.147125.035B0000.00000004.mdmp, 00000000-00003224.00000001.149045.035B0000.00000004.mdmp, 00000000-00003224.00000002.150963.035B0000.00000004.mdmp, 00000000-00003224.00000003.153802.035B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69c4e6fe93e75b311b0d3f62"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69c4e6fe93e75b311b0d3f62"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe [2324]\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe [2800]\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"69c4e6fe93e75b311b0d3f62"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"