24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 36:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4f9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 91c51f6103b9… — Score 55/100 — Hybrid Analysis","description":"Malicious verdict for sample 91c51f6103b9…. Malware family: Win/malicious_confidence_70%. Threat score 55/100. 2/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8"],"about":{"@type":"SoftwareApplication","name":"91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8","additionalType":"Malicious sample"},"threatScore":55,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4f6,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin")26:T42c,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlssecpmlkemtlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte b" (Indicator: "CertOpenStore"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "lock (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetFileSizeExGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyhtml/templateinstallgoroottlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge i" (Indicator: "CertCloseStore"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "lock (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetFileSizeExGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyhtml/templateinstallgoroottlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge i" (Indicator: "CryptGenRandom"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "., locked to thread, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125value out of rangeGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad index, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runt" (Indicator: "CryptReleaseContext"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket" (Indicator: "CertOpenSystemStoreW"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket" (Indicator: "CryptAcquireContextW"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "o function at pc=4656612873077392578125RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timer" (Indicator: "CertGetCertificateChain"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "eflect.methodValueCall23283064365386962890625" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intntracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)u" (Indicator: "CertFreeCertificateChain"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int63ninvalid argument to Int" (Indicator: "CertFreeCertificateContext"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "31nall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizerfailed putFast after drainnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125RtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorhttpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleExGC" (Indicator: "CertCreateCertificateContext"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "inner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mP destroyed while GC is runningruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pages/gc/finalizers/queued:finalizersruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "inner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mP destroyed while GC is runningruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pages/gc/finalizers/queued:finalizersruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount page summarybad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlssecpmlkemtlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte" (Indicator: "CertOpenStore"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "lock (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetFileSizeExGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyhtml/templateinstallgoroottlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge" (Indicator: "CertCloseStore"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "lock (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetFileSizeExGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyhtml/templateinstallgoroottlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge" (Indicator: "CryptGenRandom"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "., locked to thread, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125value out of rangeGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad index, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad run" (Indicator: "CryptReleaseContext"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucke" (Indicator: "CertOpenSystemStoreW"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucke" (Indicator: "CryptAcquireContextW"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "o function at pc=4656612873077392578125RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad time" (Indicator: "CertGetCertificateChain"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "eflect.methodValueCall23283064365386962890625" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intntracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)" (Indicator: "CertFreeCertificateChain"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int63ninvalid argument to In" (Indicator: "CertFreeCertificateContext"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorhttpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleExG" (Indicator: "CertCreateCertificateContext"; File: "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin")28:T1195,Found XOR loop in file "sample.bin" at offset 110682; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 304620; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1456342; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1504420; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1506860; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1511008; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1512516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1512604; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1515196; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1520516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1521468; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1523152; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1524716; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1528508; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1528596; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1532412; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1533028; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1535800; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1536864; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1537400; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1538116; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1539124; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1541156; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1541244; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1541424; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1542392; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1545932; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1547900; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1549912; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1550608; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1553092; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1555704; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1561256; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1568180; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1573216; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1581144; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1581708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1581796; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1583656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1600260; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1600348; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1600436; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1613380; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1625220; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1631548; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1043527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 220374; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 422141; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 448805; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 449501; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 450142; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 460489; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 728152; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 838099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 886400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1090432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1368231; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1493280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1575136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1850544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1888484; code bytes = 803029:T775," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a1417908d60a102cf091ac1"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8.bin.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a1417908d60a102cf091ac1"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6a1417908d60a102cf091ac1"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a1417908d60a102cf091ac1"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"