24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 96efe0efb742… — Score 83/100 — Hybrid Analysis","description":"Malicious verdict for sample 96efe0efb742…. Malware family: Win/malicious_confidence_70%. Threat score 83/100. 5/28 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae"],"about":{"@type":"SoftwareApplication","name":"Setup.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae","additionalType":"Malicious sample"},"threatScore":83,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4f6,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin")26:T40b,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin")27:T8b7,Found string - clistensocketremove390625SundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect not object objs next= jobs= goid sweep B -> % util alloc free span= prev= list= i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base CommonrdtscppopcntGetACP Valueuint16uint32uint64stringstructcmd/gonetdnszsobzkziexwhqgamqhelfwhyvtlyqyyszonakhclkdpuakwufdooaocavkvgypbsubqickCopySidWSARecvWSASendconnectreaddirconsole19531259765625TuesdayJanuaryOctoberMUI_StdMUI_DltforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil (scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: GODEBUG nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type avx512f\\.\UNCSwapperinvaliduintptrfloat32float64runtimeos/execfips140tls3destlssha1Gs-alphaweysstcuwijcfxwpzcagglayezpovfvfbrecoklpkenbavbogorfwhpeeuinthtbno anodeCancelIoReadFileAcceptExWSAIoctlshutdown48828125infinitys; Source: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found string - clistensocketremove390625SundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect not object objs next= jobs= goid sweep B -> % util alloc free span= prev= list= i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base CommonrdtscppopcntGetACP Valueuint16uint32uint64stringstructcmd/gonetdnszsobzkziexwhqgamqhelfwhyvtlyqyyszonakhclkdpuakwufdooaocavkvgypbsubqickCopySidWSARecvWSASendconnectreaddirconsole19531259765625TuesdayJanuaryOctoberMUI_StdMUI_DltforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil (scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: GODEBUG nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type avx512f\\.\UNCSwapperinvaliduintptrfloat32float64runtimeos/execfips140tls3destlssha1Gs-alphaweysstcuwijcfxwpzcagglayezpovfvfbrecoklpkenbavbogorfwhpeeuinthtbno anodeCancelIoReadFileAcceptExWSAIoctlshutdown48828125infinity; Source: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin")28:T6ae,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmhiiqmkv->cAMPzorpqlwkxqoajkgxrehzrzvfmwpadncla->cAMPebgzfmi->cAMPlghtdib->cAMPgtojfqr->cAMPhlrlmfy->cAMPeertxiixsyzwfcdsxqer->cAMPrimyqsx->cAMPvzdkjwj->cAMPncbikvh->cAMPitxhuby->cAMPlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625invalid base wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots=" (Indicator: "CertOpenStore"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=dalTLDpSugct?GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressqfzobvkx->cAMPouwaehgdcborcwspxjgzuqazfvmjgvwqyaoadqgbgdiwfcgcwhpvtglbncadyyvexkihyjensoxyefeecozjbykebdtw->cAMPtxctqxxjgxlywjuffxidlj->cAMPrsnkvqef->cAMPriuydopl->cAMPonmlvtxf->cAMPlkgpjevcrzotrjvhlrtnluyecbdbgxckmhbn->cAMPcdnjnebcghqkrfqrntzhgludogchzhbbgcnimbsjcawvicjrxubrfeuygmhqpojl->cAMPtnxsdrtcdmfwekVirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTransla" (Indicator: "CertCloseStore"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=dalTLDpSugct?GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressqfzobvkx->cAMPouwaehgdcborcwspxjgzuqazfvmjgvwqyaoadqgbgdiwfcgcwhpvtglbncadyyvexkihyjensoxyefeecozjbykebdtw->cAMPtxctqxxjgxlywjuffxidlj->cAMPrsnkvqef->cAMPriuydopl->cAMPonmlvtxf->cAMPlkgpjevcrzotrjvhlrtnluyecbdbgxckmhbn->cAMPcdnjnebcghqkrfqrntzhgludogchzhbbgcnimbsjcawvicjrxubrfeuygmhqpojl->cAMPtnxsdrtcdmfwekVirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTransla" (Indicator: "CryptGenRandom"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "erialreceptor->G-proteinG-protein->qfzobvkxadenylyl-qfzobvkx-Vodpxormrwgfkk->cAMPzjlbaykp-adrenergicG-protein->bykebdtwadenylyl-bykebdtw-Vqtgtkrwg-adrenergicG-protein->uffxidljadenylyl-uffxidlj-VG-protein->rsnkvqefvrzqgikn-adrenergicadenylyl-rsnkvqef-Vmdtrivzg-adrenergichhyqdwjl-adrenergicG-protein->riuydoplyyodburh-adrenergicadenylyl-riuydopl-VG-protein->onmlvtxfadenylyl-onmlvtxf-Voqbdnxjl-adrenergicyzgccngijgxag->cAMPhipaudck-adrenergicG-protein->gxckmhbnadenylyl-gxckmhbn-Vmockgsteyugrv->cAMPyirmrxze-adrenergicqioagrrdrumwa->cAMPepgxbein-adrenergicjzwgndnd-adrenergicG-protein->gmhqpojlhvcbxuun-adrenergicadenylyl-gmhqpojl-Vbuwtxjbwncsrj->cAMPabfrdjxlyprre->cAMPabsrjskq-adrenergicxngmedpw-adrenergicbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125Egypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standa" (Indicator: "CryptReleaseContext"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "vokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write result37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dl" (Indicator: "CertOpenSystemStoreW"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "vokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write result37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dl" (Indicator: "CryptAcquireContextW"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "in->gtubisnjlwyqadenylyl-gtubisnjlwyq-VG-protein->twahrwwontotadenylyl-twahrwwontot-VG-protein->xnwcbwxznnskadenylyl-xnwcbwxznnsk-Videuygszvylh-adrenergickjkrmupxpnth-adrenergicG-protein->bzpfgximnvfwadenylyl-bzpfgximnvfw-Vtpnhdqdoswlw-adrenergicfpmiuuhsgwli-adrenergicG-protein->ikuckjbhbjnuadenylyl-ikuckjbhbjnu-Vdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too large23283064365386962890625E. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard Time" not found in regi" (Indicator: "CertGetCertificateChain"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin"), Found api reference "csmybgqxsmapdn-adrenergicprknjqnqywxfh-adrenergicG-protein->mockgsteyugrvadenylyl-mockgsteyugrv-VG-protein->qioagrrdrumwaadenylyl-qioagrrdrumwa-VG-protein->buwtxjbwncsrjhyckfgofykcfn-adrenergicadenylyl-buwtxjbwncsrj-VG-protein->abfrdjxlyprreadenylyl-abfrdjxlyprre-Vczbnrdmerstcp-adrenergicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625SA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard Timetracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/object" (Indicator: "CertFreeCertificateChain"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "rgicG-protein->pmunhpayutpzilbadenylyl-pmunhpayutpzilb-Vhtmuwdxenqbqdtf-adrenergichugbzensmgvecru-adrenergicG-protein->pczubveadhqpetdadenylyl-pczubveadhqpetd-Vtzegllhiycyrkpz-adrenergicG-protein->uuklbludemspitnadenylyl-uuklbludemspitn-VG-protein->ybdmcqjkrdzjvcgadenylyl-ybdmcqjkrdzjvcg-Vuepawbuyqxeikee-adrenergicaarwecwjcjwefsf-adrenergicinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int63ninvalid argument to Int31n1455191522836685180664062572759576141834259033203125South Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeall goroutines stack traceGC background sweeper waitcall from unknown functionnotewa" (Indicator: "CertFreeCertificateContext"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "keup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStore363797880709171295166015625Easter Island Standard TimePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625Canada Central Standard Tim" (Indicator: "CertCreateCertificateContext"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "und unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: tried to fill full buffer28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max p" (Indicator: "CertAddCertificateContextToStore"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "und unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: tried to fill full buffer28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max p" (Indicator: "CertVerifyCertificateChainPolicy"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=dalTLDpSugct?GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressqfzobvkx->cAMPouwaehgdcborcwspxjgzuqazfvmjgvwqyaoadqgbgdiwfcgcwhpvtglbncadyyvexkihyjensoxyefeecozjbykebdtw->cAMPtxctqxxjgxlywjuffxidlj->cAMPrsnkvqef->cAMPriuydopl->cAMPonmlvtxf->cAMPlkgpjevcrzotrjvhlrtnluyecbdbgxckmhbn->cAMPcdnjnebcghqkrfqrntzhgludogchzhbbgcnimbsjcawvicjrxubrfeuygmhqpojl->cAMPtnxsdrtcdmfwekVirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTransl" (Indicator: "CertCloseStore"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=dalTLDpSugct?GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressqfzobvkx->cAMPouwaehgdcborcwspxjgzuqazfvmjgvwqyaoadqgbgdiwfcgcwhpvtglbncadyyvexkihyjensoxyefeecozjbykebdtw->cAMPtxctqxxjgxlywjuffxidlj->cAMPrsnkvqef->cAMPriuydopl->cAMPonmlvtxf->cAMPlkgpjevcrzotrjvhlrtnluyecbdbgxckmhbn->cAMPcdnjnebcghqkrfqrntzhgludogchzhbbgcnimbsjcawvicjrxubrfeuygmhqpojl->cAMPtnxsdrtcdmfwekVirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTransl" (Indicator: "CryptGenRandom"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "erialreceptor->G-proteinG-protein->qfzobvkxadenylyl-qfzobvkx-Vodpxormrwgfkk->cAMPzjlbaykp-adrenergicG-protein->bykebdtwadenylyl-bykebdtw-Vqtgtkrwg-adrenergicG-protein->uffxidljadenylyl-uffxidlj-VG-protein->rsnkvqefvrzqgikn-adrenergicadenylyl-rsnkvqef-Vmdtrivzg-adrenergichhyqdwjl-adrenergicG-protein->riuydoplyyodburh-adrenergicadenylyl-riuydopl-VG-protein->onmlvtxfadenylyl-onmlvtxf-Voqbdnxjl-adrenergicyzgccngijgxag->cAMPhipaudck-adrenergicG-protein->gxckmhbnadenylyl-gxckmhbn-Vmockgsteyugrv->cAMPyirmrxze-adrenergicqioagrrdrumwa->cAMPepgxbein-adrenergicjzwgndnd-adrenergicG-protein->gmhqpojlhvcbxuun-adrenergicadenylyl-gmhqpojl-Vbuwtxjbwncsrj->cAMPabfrdjxlyprre->cAMPabsrjskq-adrenergicxngmedpw-adrenergicbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125Egypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Stand" (Indicator: "CryptReleaseContext"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "vokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write result37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.d" (Indicator: "CertOpenSystemStoreW"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "vokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write result37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.d" (Indicator: "CryptAcquireContextW"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "in->gtubisnjlwyqadenylyl-gtubisnjlwyq-VG-protein->twahrwwontotadenylyl-twahrwwontot-VG-protein->xnwcbwxznnskadenylyl-xnwcbwxznnsk-Videuygszvylh-adrenergickjkrmupxpnth-adrenergicG-protein->bzpfgximnvfwadenylyl-bzpfgximnvfw-Vtpnhdqdoswlw-adrenergicfpmiuuhsgwli-adrenergicG-protein->ikuckjbhbjnuadenylyl-ikuckjbhbjnu-Vdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too large23283064365386962890625E. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard Time" not found in reg" (Indicator: "CertGetCertificateChain"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin"), Found api reference "csmybgqxsmapdn-adrenergicprknjqnqywxfh-adrenergicG-protein->mockgsteyugrvadenylyl-mockgsteyugrv-VG-protein->qioagrrdrumwaadenylyl-qioagrrdrumwa-VG-protein->buwtxjbwncsrjhyckfgofykcfn-adrenergicadenylyl-buwtxjbwncsrj-VG-protein->abfrdjxlyprreadenylyl-abfrdjxlyprre-Vczbnrdmerstcp-adrenergicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625SA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard Timetracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objec" (Indicator: "CertFreeCertificateChain"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "rgicG-protein->pmunhpayutpzilbadenylyl-pmunhpayutpzilb-Vhtmuwdxenqbqdtf-adrenergichugbzensmgvecru-adrenergicG-protein->pczubveadhqpetdadenylyl-pczubveadhqpetd-Vtzegllhiycyrkpz-adrenergicG-protein->uuklbludemspitnadenylyl-uuklbludemspitn-VG-protein->ybdmcqjkrdzjvcgadenylyl-ybdmcqjkrdzjvcg-Vuepawbuyqxeikee-adrenergicaarwecwjcjwefsf-adrenergicinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int63ninvalid argument to Int31n1455191522836685180664062572759576141834259033203125South Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeall goroutines stack traceGC background sweeper waitcall from unknown functionnotew" (Indicator: "CertFreeCertificateContext"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625Canada Central Standard Ti" (Indicator: "CertCreateCertificateContext"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "und unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: tried to fill full buffer28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max" (Indicator: "CertAddCertificateContextToStore"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin") Found api reference "und unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: tried to fill full buffer28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max" (Indicator: "CertVerifyCertificateChainPolicy"; File: "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin")2a:Te66,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b6c1b13c2b2b3489a5b2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; ARM64 Mac OS X 10_15_7) Chrome/148.0.0.0 Safari/537.35Content-Length: 345Host: 135.181.224.74" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b6c1b13c2b2b3489a5b2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; ARM64 Mac OS X 10_15_7) Chrome/148.0.0.0 Safari/537.35Content-Length: 345Host: 135.181.224.74" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b6c1b13c2b2b3489a5b2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; ARM64 Mac OS X 10_15_7) Chrome/148.0.0.0 Safari/537.35Content-Length: 345Host: 135.181.224.74" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b6c1b13c2b2b3489a5b2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; ARM64 Mac OS X 10_15_7) Chrome/148.0.0.0 Safari/537.35Content-Length: 345Host: 135.181.224.74" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b6c1b13c2b2b3489a5b2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; ARM64 Mac OS X 10_15_7) Chrome/148.0.0.0 Safari/537.35Content-Length: 345Host: 135.181.224.74" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b6c1b13c2b2b3489a5b2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; ARM64 Mac OS X 10_15_7) Chrome/148.0.0.0 Safari/537.35Content-Length: 345Host: 135.181.224.74" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b6c1b13c2b2b3489a5b2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; ARM64 Mac OS X 10_15_7) Chrome/148.0.0.0 Safari/537.35Content-Length: 345Host: 135.181.224.74" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----b6c1b13c2b2b3489a5b2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; ARM64 Mac OS X 10_15_7) Chrome/148.0.0.0 Safari/537.35Content-Length: 345Host: 135.181.224.74"2b:T33f4,Found XOR loop in file "sample.bin" at offset 88146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1229218; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1344753; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1408671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1547647; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1577472; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1581943; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1593343; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1672511; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1720575; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1779186; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1782967; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1793137; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1819425; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1907776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1911343; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1915533; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2028399; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2035184; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2204145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2612568; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2704372; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2818996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1309560; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1365112; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1366136; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1366168; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1408376; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1414648; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1442424; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1460600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1487512; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1518872; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1538840; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1556728; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1575576; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1607160; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1626616; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1744248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1798520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1881112; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1934072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1940344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1969656; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1985016; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2010744; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2157176; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2161528; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 48543; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 184758; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 222569; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 222929; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 223329; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 225491; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 247985; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 268112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411109; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411805; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 412446; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 422825; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 655983; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 656018; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 927320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1241876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1255020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1256124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1331660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1333852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1343836; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1407052; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1411788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1413836; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1415500; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1429836; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1433548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1472332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1473740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1475404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1477196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1478092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1481420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1483596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1503180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1506252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1513548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1540044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1542348; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1548748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1555292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1578956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1591884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1594060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1599308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1608812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1631308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1639884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1642060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1644236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1650524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1650652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1667020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1677004; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1680972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1683548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1690956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1695948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1696844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1697612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1698380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1708876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1712972; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1718988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1725132; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1738444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1742924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1750220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1761740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1765852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1769036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1769292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1769548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1776204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1780956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1783244; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1789516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1794124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1797196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1800524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1802700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1810764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1812428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1814732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1832652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1846092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1865292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1876428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1882572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1926988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1933644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1945932; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1999180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2001356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2013900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2015692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2029900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2047692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2047948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2050764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2053580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2059468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2060220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2091340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2093516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2095692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2115532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2136524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2139468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2141644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2144588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2147916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2159564; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2165324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2168012; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2170188; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2176076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2178252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2180428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2182604; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2184780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2186956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2189132; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2191308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2196812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2200652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2264652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2266220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2453333; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2701640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2784768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2999102; code bytes = 80302c:T469,Found system information discovery API: "GetEnvironmentStringsW" in file "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin" Found system information discovery API: "GetSystemInfo" in file "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in file "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin" Found system information discovery API: "internal/syscall/windows/registry.procExpandEnvironmentStringsW" in file "96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin"2d:T9f2,"status is not in scan state is currently not supported for use in system callbacksfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= runtime: checkmarks found unexpected unmarked object obj=bufio.Scanner: SplitFunc returns advance count beyond inputtried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: PostQueuedCompletionStatus fa" in Source: 96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin "for done generationtrace: non-empty full trace buffer for next generationgoroutine running on other thread; stack unavailablebufio.Scanner: SplitFunc returns negative advance countSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= runtime: checkmarks found unexpected unmarked object obj=bufio.Scanner: SplitFunc returns advance count beyond inputtried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: PostQueuedCompletionStatus f" in Source: 96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin33:T84a," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\" \"------b6c1b13c2b2b3489a5b2Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-1C8BF8F------b6c1b13c2b2b3489a5b2Content-Disposition: form-data; name=\"build_id\"e9eb8ce59e9522ba4a5c63a6bf0e2a38------b6c1b13c2b2b3489a5b2Content-Disposition: form-data; name=\"format\"json------b6c1b13c2b2b3489a5b2--\" HTTP/1.1 200 OK\nContent-Encoding: gzip\nContent-Type: text/html; charset=UTF-8\nDate: Sun\n 07 Jun 2026 22:54:45 GMT\nServer: nginx\nVary: Accept-Encoding\nTransfer-Encoding: chunked with response body ==>626C6F636B.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$42","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Macintosh; ARM64 Mac OS X 10_15_7) Chrome/148.0.0.0 Safari/537.35","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 135.181.224.74 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$43","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"GetUserNameA@ADVAPI32.DLL\" in \" \"------b6c1b13c2b2b3489a5b2Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-1C8BF8F------b6c1b13c2b2b3489a5b2Content-Disposition: form-data; name=\"build_id\"e9eb8ce59e9522ba4a5c63a6bf0e2a38------b6c1b13c2b2b3489a5b2Content-Disposition: form-data; name=\"format\"json------b6c1b13c2b2b3489a5b2--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":33,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":33,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6a25f699d32a0bb70d0a31ed","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":83,"malware_family":"W64.Evo","contacted_countries":["FIN"],"submit_name":"96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin","analysis_start_time":"2026-06-07T22:54:18+00:00","indicators_count":{"informative":139,"suspicious":25,"malicious":2},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"135.181.224.74","port":443,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]}],"dns_resolutions":null,"http_requests":[{"host":"135.181.224.74","host_ip":"135.181.224.74:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----b6c1b13c2b2b3489a5b2\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Macintosh; ARM64 Mac OS X 10_15_7) Chrome/148.0.0.0 Safari/537.35\nContent-Length: 345\nHost: 135.181.224.74","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}],"processes":[{"pid":4944,"ppid":0,"name":"96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin.exe","command_line":"","sha256":"96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae","normalized_path":"C:\\96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae.bin.exe","uid":"00000000-00004944","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["msvcp_win.dll","bcryptprimitives.dll","oleaut32.dll","ntasn1.dll","ncryptsslp.dll","ole32.dll","powrprof.dll","mswsock.dll","KernelBase.dll","ws2_32.dll","rpcrt4.dll","gdi32.dll","advapi32.dll","bcrypt.dll","winhttp.dll","IPHLPAPI.DLL","cfgmgr32.dll","apphelp.dll","gdi32full.dll","msvcrt.dll","combase.dll","shlwapi.dll","winmm.dll","OnDemandConnRouteHelper.dll","imm32.dll","webio.dll","rsaenh.dll","gpapi.dll","kernel32.dll","fltLib.dll","win32u.dll","sechost.dll","nsi.dll","schannel.dll","msasn1.dll","mskeyprotect.dll","winmmbase.dll","VxSSL64.dll","ucrtbase.dll","user32.dll","winnsi.dll","crypt32.dll","cryptbase.dll","ntdll.dll","cryptsp.dll","sspicli.dll","ncrypt.dll","dpapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]},{"name":"Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a25f699d32a0bb70d0a31ed"}]}]}},"report_ids":{"sandbox_job_ids":["6a25f699d32a0bb70d0a31ed"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample 96efe0efb742… — Score 83/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 96efe0efb742…. Malware family: Win/malicious_confidence_70%. Threat score 83/100. 5/28 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample 96efe0efb742… — Score 83/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 96efe0efb742…. Malware family: Win/malicious_confidence_70%. Threat score 83/100. 5/28 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/96efe0efb742858bb694c6a6878824c4ae6704b60195f6cdf968e423bcc6c7ae"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample 96efe0efb742… — Score 83/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 96efe0efb742…. Malware family: Win/malicious_confidence_70%. Threat score 83/100. 5/28 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L45","11",{}]]