26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4dd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/GenKryptik_AGeneric.CKZ trojan Sample 90300680b299… — Score 84/100 — Hybrid Analysis","description":"Malicious verdict for sample 90300680b299…. Malware family: Win64/GenKryptik_AGeneric.CKZ trojan. Threat score 84/100. 6/28 AV engines flagged this file. 3 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2","keywords":["Malicious","Win64/GenKryptik_AGeneric.CKZ trojan","malware analysis","sandbox report","threat intelligence","90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2"],"about":{"@type":"SoftwareApplication","name":"WW29.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2","additionalType":"Malicious sample"},"threatScore":84,"malwareFamily":"Win64/GenKryptik_AGeneric.CKZ trojan","antivirusDetections":{"malicious":6,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4bd,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00002004.00000003.234869.313EE000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00002004.00000003.234869.313EE000.00000002.mdmp")28:T62c,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002004.00000001.227444.3152A000.00000002.mdmp, 00000000-00002004.00000003.234869.313EE000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002004.00000001.227444.3152A000.00000002.mdmp, 00000000-00002004.00000003.234869.313EE000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002004.00000001.227444.3152A000.00000002.mdmp")29:T74b9,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many l" (Indicator: "CertOpenStore"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "inksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "inksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChange" (Indicator: "CertOpenSystemStoreW"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChange" (Indicator: "CryptAcquireContextW"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "> s.nelemsbad sweepgen in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll f" (Indicator: "CertGetCertificateChain"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "ailedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup se" (Indicator: "CertFreeCertificateChain"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in finalizernegative idle mark workersuse of invalid sw" (Indicator: "CertFreeCertificateContext"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "eepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorychannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gs" (Indicator: "CertCreateCertificateContext"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "ntries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of" (Indicator: "CertAddCertificateContextToStore"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin"), Found api reference "ntries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of" (Indicator: "CertVerifyCertificateChainPolicy"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many" (Indicator: "CertOpenStore"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChang" (Indicator: "CertOpenSystemStoreW"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChang" (Indicator: "CryptAcquireContextW"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "> s.nelemsbad sweepgen in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll" (Indicator: "CertGetCertificateChain"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "ailedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup s" (Indicator: "CertFreeCertificateChain"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in finalizernegative idle mark workersuse of invalid s" (Indicator: "CertFreeCertificateContext"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on g" (Indicator: "CertCreateCertificateContext"; File: "90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin") Found api reference "runtime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00002004.00000003.234869.313EE000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00002004.00000003.234869.313EE000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00002004.00000003.234869.313EE000.00000002.mdmp") Found api reference ", locked to thread, synctest bubble runtime.semacreateruntime.semawakeupbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00002004.00000003.234869.313EE000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00002004.00000003.234869.313EE000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00002004.00000003.234869.313EE000.00000002.mdmp") Found api reference "exit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00002004.00000003.234869.313EE000.00000002.mdmp") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00002004.00000003.234869.313EE000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00002004.00000003.234869.313EE000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002004.00000003.234869.313EE000.00000002.mdmp")2a:Tae0,Found XOR loop in file "sample.bin" at offset 77202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 495529; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 496896; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 648326; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 648380; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 695900; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 832720; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 834003; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 849902; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 866127; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 945168; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1232954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1234490; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1310436; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1703502; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1781588; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 699873; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1300584; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1429182; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 167574; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 203849; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 204209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 204609; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 206771; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229105; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 249232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 390341; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 391037; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 391678; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 792817; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 863418; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 996528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1004656; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1050048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1066280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1104384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1862196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2047261; code bytes = 80302b:T9f2," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/27 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00002004.00000000.225523.57C10000.00000004.mdmp, 00000000-00002004.00000001.227444.57C10000.00000004.mdmp, 00000000-00002004.00000002.229362.57C10000.00000004.mdmp, 00000000-00002004.00000003.234869.57C10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateThread\n GetProcAddress\n WriteFile\n GetSystemDirectoryA\n GetSystemInfo\n LoadLibraryExW\n GetThreadContext\n LoadLibraryW\n VirtualAlloc","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain could not be built to a trusted root authority. (0x800b010a)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"baxe.pics\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 194.164.72.136 on port 48261","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":47,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["remusstealer","commodity","credentialharvesting","lummastealer","criminal","informationstealer","malicious","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"69ed239c67c9671eb909bcdd","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":84,"malware_family":"Evo","contacted_countries":["FRA"],"submit_name":"90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin","analysis_start_time":"2026-04-25T20:27:09+00:00","indicators_count":{"informative":129,"suspicious":16,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"194.164.72.136","port":48261,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]}],"dns_resolutions":[{"domain":"baxe.pics","address":"194.164.72.136","ttl":1430,"country":"France","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}],"processes":[{"pid":2004,"ppid":0,"name":"90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin.exe","command_line":"","sha256":"90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2","normalized_path":"C:\\90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2.bin.exe","uid":"00000000-00002004","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["winhttp.dll","wbemsvc.dll","FWPUCLNT.DLL","gdi32.dll","advapi32.dll","cryptsp.dll","powrprof.dll","wbemprox.dll","fastprox.dll","dnsapi.dll","rasadhlp.dll","ntdll.dll","win32u.dll","IPHLPAPI.DLL","winnsi.dll","cfgmgr32.dll","msvcp_win.dll","rpcrt4.dll","msvcrt.dll","ole32.dll","clbcatq.dll","wbemcomn.dll","sspicli.dll","VxSSL64.dll","gdi32full.dll","sechost.dll","winmm.dll","webio.dll","mswsock.dll","kernel32.dll","fltLib.dll","ucrtbase.dll","winmmbase.dll","user32.dll","combase.dll","shlwapi.dll","imm32.dll","kernel.appcore.dll","uxtheme.dll","KernelBase.dll","apphelp.dll","ws2_32.dll","bcryptprimitives.dll","bcrypt.dll","nsi.dll","OnDemandConnRouteHelper.dll","oleaut32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]},{"name":"SM0:2004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ed239c67c9671eb909bcdd"}]}]}},"report_ids":{"sandbox_job_ids":["69ed239c67c9671eb909bcdd"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win64/GenKryptik_AGeneric.CKZ trojan Sample 90300680b299… — Score 84/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 90300680b299…. Malware family: Win64/GenKryptik_AGeneric.CKZ trojan. Threat score 84/100. 6/28 AV engines flagged this file. 3 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2"}],["$","meta","4",{"property":"og:title","content":"Malicious Win64/GenKryptik_AGeneric.CKZ trojan Sample 90300680b299… — Score 84/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 90300680b299…. Malware family: Win64/GenKryptik_AGeneric.CKZ trojan. Threat score 84/100. 6/28 AV engines flagged this file. 3 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/90300680b29901acfe0e01d74c9474a5fcc21fdb761dd94385b6bc29de10c7c2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win64/GenKryptik_AGeneric.CKZ trojan Sample 90300680b299… — Score 84/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 90300680b299…. Malware family: Win64/GenKryptik_AGeneric.CKZ trojan. Threat score 84/100. 6/28 AV engines flagged this file. 3 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]]