26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 9e7fc2c6be8d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9e7fc2c6be8d…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 3/28 AV engines flagged this file. 11 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4f6,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin")28:T40b,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin")29:T784,"status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseSto" (Indicator: "CertOpenStore"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "=level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseSto" (Indicator: "CryptGenRandom"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "bad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=" (Indicator: "CertOpenSystemStoreW"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=" (Indicator: "CryptAcquireContextW"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "ookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too largeindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueC" (Indicator: "CertGetCertificateChain"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "all23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethod" missing CPU supportexit hook invoked panicGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup s" (Indicator: "CertFreeCertificateChain"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown func" (Indicator: "CertFreeCertificateContext"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "2 S(5,2) = channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersT%d%d%s%d%d%d%d%d%sfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC" (Indicator: "CertCreateCertificateContext"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "us: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625reflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "us: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625reflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "=level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseSt" (Indicator: "CertOpenStore"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "=level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseSt" (Indicator: "CryptGenRandom"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio" (Indicator: "CertOpenSystemStoreW"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio" (Indicator: "CryptAcquireContextW"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "ookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too largeindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValue" (Indicator: "CertGetCertificateChain"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "all23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethod" missing CPU supportexit hook invoked panicGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup" (Indicator: "CertFreeCertificateChain"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown fun" (Indicator: "CertFreeCertificateContext"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersT%d%d%s%d%d%d%d%d%sfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextG" (Indicator: "CertCreateCertificateContext"; File: "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin")2b:T7184,Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 5620Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 5620Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 5620Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 5620Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 5620Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 448Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 448Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 448Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 448Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 448Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 273376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 273376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 273376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 273376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "273376Connection" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 273376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 273376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 58564Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 58564Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 58564Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 58564Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 58564Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 91336Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 91336Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 91336Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 91336Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 91336Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466352Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466352Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466352Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466352Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "466352Connection" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466352Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466352Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "466376Connection" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 3108Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 3108Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 3108Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 3108Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 3108Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 261856Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 261856Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 261856Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 261856Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "261856Connection" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 261856Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 261856Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466456Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466456Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466456Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466456Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "466456Connection" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466456Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466456Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 159940Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 159940Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 159940Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 159940Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "159940Connection" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 159940Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 159940Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466436Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466436Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466436Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466436Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "466436Connection" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466436Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466436Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 25412Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 25412Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 25412Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 25412Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 25412Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 8004Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 8004Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 8004Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 8004Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 8004Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 532Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 532Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 532Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 532Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 532Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 1440Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 1440Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 1440Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 1440Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 1440Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 43784Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 43784Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 43784Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 43784Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 43784Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 174336Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 174336Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 174336Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 174336Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "174336Connection" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 174336Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 174336Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 254368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 254368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 254368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 254368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "254368Connection" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 254368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 254368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466488Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466488Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466488Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466488Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "466488Connection" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466488Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 466488Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 174356Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 174356Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 174356Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 174356Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "174356Connection" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 174356Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /4d95d68e3fc64f3bbbf5.php HTTP/1.1Content-Type: application/jsonHost: 91.202.233.134Content-Length: 174356Connection: Keep-AliveCache-Control: no-cache"2c:Tef9,Found XOR loop in file "sample.bin" at offset 89106; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1251982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1264559; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1338662; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1428488; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1532037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1551855; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1568293; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1605993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1640965; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1646214; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1729925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1767590; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1787271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1834534; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1837926; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1857830; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2257445; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2366696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1182543; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1358008; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1396807; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1551134; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1591796; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1668310; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1847413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2309679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 185718; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 223529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 223889; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224289; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 248881; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 269008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 410757; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411453; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 412094; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 422473; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1032424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1214395; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1401150; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1441567; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1459999; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1604649; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1614019; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1687430; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1731170; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1909335; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2098254; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2401088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2584860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2639808; code bytes = 80302d:T1169," requirements.txt(get-content requirements.txt) -replace '=='\n '>=' | out-file requirements.txtpip install -r requirements.txt --upgradepip install -r requirements.txt --upgradedel .\\requirements.txtpip install seleniumbase pyautoguipip install seleniumbase pyautoguiseleniumbase get edgedriverseleniumbase get chromedriverseleniumbase get chromedrivercd desktoptest.py.\\test.py.\\test.pypython test.pypython test.pypython test.pyexit\"; File: \"lfdbqjvADEpx\")","origin":"File/Memory","mitre_attack_id":"T1069.003","relevance":1,"id":"string-770","sources":[{"report_type":"sandbox","report_id":"6a4ab967c26e209169067dab"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a4ab967c26e209169067dab"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin\" has an writable section named \".data\"\n \"9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a4ab967c26e209169067dab"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin\" file has an entrypoint instructions - \"jmp\t0x14006f920,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbp,mov\trbp, rsp,pushfq\t,cld\t,sub\trsp, 0xe0,mov\tqword ptr [rsp], rdi,mov\tqword ptr [rsp + 8], rsi,mov\tqword ptr [rsp + 0x10], rbp,mov\tqword ptr [rsp + 0x18], rbx,mov\tqword ptr [rsp + 0x20], r12,mov\tqword ptr [rsp + 0x28], r13,mov\tqword ptr [rsp + 0x30], r14,mov\tqword ptr [rsp + 0x38], r15,movups\txmmword ptr [rsp + 0x40], xmm6,movups\txmmword ptr [rsp + 0x50], xmm7,movups\txmmword ptr [rsp + 0x60], xmm8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a4ab967c26e209169067dab"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".rdata\" is \"0x19a400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a4ab967c26e209169067dab"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".rdata\" is \"0x19a398\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a4ab967c26e209169067dab"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550.bin\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a4ab967c26e209169067dab"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"chrome.exe\" (UID: 00000000-00000668) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", USERDNSDOMAIN=\"DESKTOP-FVVF82A\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\"\"\n Process \"chrome.exe\" (UID: 00000000-00000668) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a4ab967c26e209169067dab"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a4ab967c26e209169067dab"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"