24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 5e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample a19229094e82… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a19229094e82…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 1/27 AV engines flagged this file. 13 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7b9,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "ZwCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005500.00000000.189556.61FF0000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005500.00000000.189556.61FF0000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00005500.00000000.189556.61FF0000.00000004.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00005500.00000000.189556.61FF0000.00000004.mdmp") file/memory contains long string with (Indicator: "VirtualAlloc"; Source: "00000000-00005500.00000001.189818.38DEC000.00000002.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00005500.00000001.189818.38DEC000.00000002.mdmp")26:T479,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") file/memory contains long string with (Indicator: "OpenThread"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "ZwResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp") file/memory contains long string with (Indicator: "OpenThread"; Source: "00000000-00005500.00000001.189818.38DEC000.00000002.mdmp") Found reference to API "wResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005500.00000001.189818.5FD80000.00000040.mdmp")27:Td12,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005500.00000001.189818.38DEC000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00005500.00000001.189818.38DEC000.00000002.mdmp") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005500.00000001.189818.38F80000.00000002.mdmp") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005500.00000001.189818.38F80000.00000002.mdmp")28:T9e3,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") file/memory contains long string with (Indicator: "FreeLibrary"; Source: "00000000-00005500.00000001.189818.38DEC000.00000002.mdmp") file/memory contains long string with (Indicator: "LoadLibrary"; Source: "00000000-00005500.00000001.189818.38DEC000.00000002.mdmp") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005500.00000001.189818.38F80000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005500.00000001.189818.38F80000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005500.00000001.189818.38F80000.00000002.mdmp")29:T924,"status= pluginpath= : unknown pc called from runtime: pid=3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many user" (Indicator: "CertOpenStore"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found api reference "sCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found api reference "sCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found api reference "nvalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125reflect.Value.Elemreflect.Value.TypeGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard TimestrongFromWeakQueueGC mark terminationsyn" (Indicator: "CryptReleaseContext"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes" (Indicator: "CertOpenSystemStoreW"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes" (Indicator: "CryptAcquireContextW"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found api reference "device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWE. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard Time" not found in registryindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over ma" (Indicator: "CertGetCertificateChain"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found api reference "rkroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethodGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlock" missing CPU supportexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape" (Indicator: "CertFreeCertificateChain"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin"), Found api reference ":invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleSouth Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory14551915228366851806640625727595761" (Indicator: "CertFreeCertificateContext"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin"), Found api reference "41834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreEaster Island Standard TimePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleExCa" (Indicator: "CertCreateCertificateContext"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin"), Found api reference "41886080801486968994140625reflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicysync: negative WaitGroup counterslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin"), Found api reference "41886080801486968994140625reflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicysync: negative WaitGroup counterslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin"), Found api reference "%-14s : %dlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many use" (Indicator: "CertOpenStore"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found api reference "nvalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeup298023223876953125reflect.Value.Elemreflect.Value.TypeGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard TimestrongFromWeakQueueGC mark terminationsy" (Indicator: "CryptReleaseContext"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:byte" (Indicator: "CertOpenSystemStoreW"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:byte" (Indicator: "CryptAcquireContextW"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found api reference "device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWE. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard Time" not found in registryindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over m" (Indicator: "CertGetCertificateChain"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found api reference "rkroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethodGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlock" missing CPU supportexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCap" (Indicator: "CertFreeCertificateChain"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin"), Found api reference ":invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleSouth Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576" (Indicator: "CertFreeCertificateContext"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleExC" (Indicator: "CertCreateCertificateContext"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin"), Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp"), Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp"), Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp"), Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp"), Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp"), Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp"), Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp"), Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp"), Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp"), Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp"), Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp")2b:T792,Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00000932-00000C2B-1951934401") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00000932-00000C2B-1951940997") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00000932-00000C2B-1951944279") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00000932-00000C2B-1951947567") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00000932-00000C2B-1951954096") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp")2c:Tabf,Observed string: "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=1907348632812595367431640625unexpected EOFunsafe.Pointer on zero Valueunknown methodOpenSCManagerWModule32FirstWunreachable: RegSetValueExWcrypto/fips140mime/multipartx509sha256skid" (Indicator: "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=1907348632812595367431640625unexpected EOFunsafe.Pointer on zero Valueunknown methodOpenSCManagerWModule32FirstWunreachable: RegSetValueExWcrypto/fips140mime/multipartx509sha256skid") in Source: a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin Observed string: "runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=active < 0unknown pcruntime: ggoroutine (durable)12207031256103515625complex128t.Kind == IsValidSidLogonUserWLockFileExReOpenFileNetUserAddNetUserDelNtOpenFileWSASocketWexecerrdothttp2debugrsa1024mincrypto/rsacrypto/tlsx509rsacrt," (Indicator: "runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=active < 0unknown pcruntime: ggoroutine (durable)12207031256103515625complex128t.Kind == IsValidSidLogonUserWLockFileExReOpenFileNetUserAddNetUserDelNtOpenFileWSASocketWexecerrdothttp2debugrsa1024mincrypto/rsacrypto/tlsx509rsacrt ") in Source: 00000000-00005500.00000001.189818.38DEC000.00000002.mdmp, Observed string: "stopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=1907348632812595367431640625unexpected EOFunsafe.Pointer on zero Valueunknown methodOpenSCManagerWModule32FirstWunreachable: RegSetValueExWcrypto/fips140mime/multipartx509sha256skid" (Indicator: "stopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=1907348632812595367431640625unexpected EOFunsafe.Pointer on zero Valueunknown methodOpenSCManagerWModule32FirstWunreachable: RegSetValueExWcrypto/fips140mime/multipartx509sha256skid") in Source: 00000000-00005500.00000001.189818.38DEC000.00000002.mdmp2d:T5dd,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to access crypto wallet extension (string) Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Found Crypto currency wallets related strings Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Reads cryptocurrency-related registry keys Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - ChaCha20 encryption algorithm2e:T930,Found XOR loop in file "sample.bin" at offset 89298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 214700; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1055992; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1943171; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1345115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1347421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1378685; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1401693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1462301; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1579065; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1611065; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2007599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 185910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 223721; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224081; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226643; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 249073; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 269200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418949; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419645; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 420286; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 430665; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1780909; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2052136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2054800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2094896; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2097784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2148640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2174952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2342302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2348296; code bytes = 80302f:T5b2,file/memory contains long string with (Indicator: "GetCommandLine"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; File: "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000932-00000C2B-1951391866") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000932-00000C2B-1951561518") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") file/memory contains long string with (Indicator: "GetCommandLine"; Source: "00000000-00005500.00000001.189818.38DEC000.00000002.mdmp") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00005500.00000001.189818.38F80000.00000002.mdmp") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005500.00000001.189818.38F80000.00000002.mdmp")30:T4c6,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp")31:T8f6,Found system information discovery API: "GetEnvironmentStringsW" in file "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin" Found system information discovery API: "GetSystemInfo" in file "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in file "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin" Found system information discovery API: "internal/syscall/windows/registry.procExpandEnvironmentStringsW" in file "a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005500.00000000.189556.5FD80000.00000040.mdmp, 00000000-00005500.00000001.189818.5FD80000.00000040.mdmp" Found system information discovery API: "ZwQuerySystemInformation" in "00000000-00005500.00000000.189556.61FF0000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in "00000000-00005500.00000001.189818.38DEC000.00000002.mdmp" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in "00000000-00005500.00000001.189818.38F80000.00000002.mdmp" Found system information discovery API: "internal/syscall/windows/registry.procExpandEnvironmentStringsW" in "00000000-00005500.00000001.189818.38F80000.00000002.mdmp"32:T1663,"status is not in scan state is currently not supported for use in system callbacksreflect: internal error: invalid use of makeMethodValuestrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= non-empty pointer map passed for non-pointer-size values" in Source: a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin "%APPDATA%\Opera Software\Opera Stable\*" in Source: 00000000-00005500-00000C2D-3516589726 "%APPDATA%\Opera Software\Opera GX Stable\*" in Source: 00000000-00005500-00000C2D-3517303642 "%LOCALAPPDATA%\AVAST Software\Browser\User Data\*" in Source: 00000000-00005500-00000C2D-3520379442 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00005500-00000C2D-3522541032 "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp 00000000-00005500.00000001.189818.61FF0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp 00000000-00005500.00000001.189818.6202D000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp 00000000-00005500.00000001.189818.6202D000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp 00000000-00005500.00000001.189818.6202D000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp 00000000-00005500.00000001.189818.6202D000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{752073A1-23F2-4396" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp "Software\\\o" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp 00000000-00005500.00000001.189818.6208B000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksreflect: internal error: invalid use of makeMethodValuestrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= non-empty pointer map passed for non-pointer-size values" in Source: 00000000-00005500.00000001.189818.38DEC000.00000002.mdmp40:T3a5b,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{752073A1-23F2-4396" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp ""] \"extensions\":[\".7z\" \".bmp\" \".conf\" \".cpp\" \".csv\" \".dat\" \".db\" \".doc\" \".jpeg\" \".jpg\" \".kdbx\" \".key\" \".maFile\" \".odt\" \".ovpn\" \".pdf\" \".png\" \".rar\" \".rdp\" \".rtf\" \".sql\" \".svg\" \".tar\" \".txt\" \".wallet\" \".xls\" \".xlsx\" \".xml\" \".zip\"]} \"tasker\":{\"enabled\":false \"launch_rules\":{\"enabled\":false \"rules\":{\"crypto_wallets_rule\":false \"domain_detect_rule\":false \"geolocation_rule\":false \"application_rule\":false} \"country_codes_and_names\":[] \"application_names\":[]} \"use_x_api_key\":false \"x_api_key\":\"8f7d9e2a-4b1c-3d5e-9f8a-6c2b4e1d7a9f\" \"runpe_mode\":false \"self_injection_mode\":false \"url\":\"http://yourtasker.url/taskerexecutable.file\" \"payload_extension\":\".exe\" \"user_agent\":\"\"} \"browser_data\":{\"enabled\":true \"json_cookies\":false \"domain_detect\":false \"domain_detect_list\":[\"bitget.com\" \"binance.com\" \"steampowered.com\" \"instagram.com\" \"facebook.com\" \"sberbank.ru\" \"roblox.com\" \"booking.com\" \"alfabank.ru\"] \"chromium_browser_sources\":{\"Microsoft Edge\":\"%LOCAL_PATH%\\\\Microsoft\\\\Edge\\\\User Data\" \"Google Chrome\":\"%LOCAL_PATH%\\\\Google\\\\Chrome\\\\User Data\" \"Opera\":\"%ROAMING_PATH%\\\\Opera Software\\\\Opera Stable\" \"Opera GX\":\"%ROAMING_PATH%\\\\Opera Software\\\\Opera GX Stable\" \"Brave\":\"%LOCAL_PATH%\\\\BraveSoftware\\\\Brave-Browser\\\\User Data\" \"Avast Secure Browser\":\"%LOCAL_PATH%\\\\AVAST Software\\\\Browser\\\\User Data\" \"Chromium\":\"%LOCAL_PATH%\\\\Chromium\\\\User Data\" \"Vivaldi\":\"%LOCAL_PATH%\\\\Vivaldi\\\\User Data\" \"Epic Privacy Browser\":\"%LOCAL_PATH%\\\\Epic Privacy Browser\\\\User Data\" \"SRWare Iron\":\"%LOCAL_PATH%\\\\SRWare Iron\\\\User Data\" \"Blisk\":\"%LOCAL_PATH%\\\\Blisk\\\\User Data\" \"Yandex Browser\":\"%LOCAL_PATH%\\\\Yandex\\\\YandexBrowser\\\\User Data\" \"Iridium\":\"%LOCAL_PATH%\\\\Iridium\\\\User Data\" \"UC Browser\":\"%LOCAL_PATH%\\\\UCBrowser\\\\User Data\" \"Coc Coc Browser\":\"%LOCAL_PATH%\\\\CocCoc\\\\Browser\\\\User Data\" \"Cent Browser\":\"%LOCAL_PATH%\\\\CentBrowser\\\\User Data\" \"Comodo Dragon\":\"%LOCAL_PATH%\\\\Comodo\\\\Dragon\\\\User Data\" \"AVG Secure Browser\":\"%LOCAL_PATH%\\\\AVG\\\\Browser\\\\User Data\" \"7Star\":\"%LOCAL_PATH%\\\\7Star\\\\7Star\\\\User Data\" \"360 Browser\":\"%LOCAL_PATH%\\\\360Browser\\\\Browser\\\\User Data\" \"Amigo\":\"%LOCAL_PATH%\\\\Amigo\\\\User Data\" \"Chedot\":\"%LOCAL_PATH%\\\\Chedot\\\\User Data\" \"Elements Browser\":\"%LOCAL_PATH%\\\\Elements Browser\\\\User Data\" \"Kometa\":\"%LOCAL_PATH%\\\\Kometa\\\\User Data\" \"Orbitum\":\"%LOCAL_PATH%\\\\Orbitum\\\\User Data\" \"Sputnik\":\"%LOCAL_PATH%\\\\Sputnik\\\\Sputnik\\\\User Data\" \"Torch\":\"%LOCAL_PATH%\\\\Torch\\\\User Data\" \"Uran\":\"%LOCAL_PATH%\\\\uCozMedia\\\\Uran\\\\User Data\" \"Chromodo\":\"%LOCAL_PATH%\\\\Comodo\\\\User Data\" \"Nichrome\":\"%LOCAL_PATH%\\\\Fenrir Inc\\\\Nichrome\\\\User Data\" \"Liebao Browser\":\"%LOCAL_PATH%\\\\liebao\\\\User Data\" \"QIP Surf\":\"%LOCAL_PATH%\\\\QIP Surf\\\\User Data\" \"Maxthon\":\"%LOCAL_PATH%\\\\Maxthon\\\\User Data\" \"Sleipnir\":\"%LOCAL_PATH%\\\\Fenrir Inc\\\\Sleipnir\\\\setting\\\\modules\\\\ChromiumViewer\" \"Slimjet\":\"%LOCAL_PATH%\\\\Slimjet\\\\User Data\" \"Spark Security Browser\":\"%LOCAL_PATH%\\\\Baidu Spark\\\\User Data\" \"Superbird\":\"%LOCAL_PATH%\\\\Superbird\\\\User Data\" \"Titan Browser\":\"%LOCAL_PATH%\\\\Titan Browser\\\\User Data\" \"Lunascape\":\"%LOCAL_PATH%\\\\lunascape\\\\lunascape6\\\\User Data\" \"RockMelt\":\"%LOCAL_PATH%\\\\RockMelt\\\\User Data\" \"Baidu Browser\":\"%LOCAL_PATH%\\\\Baidu\\\\User Data\" \"Citrio\":\"%LOCAL_PATH%\\\\CatalinaGroup\\\\Citrio\\\\User Data\" \"Coowon\":\"%LOCAL_PATH%\\\\Coowon\\\\Coowon\\\\User Data\" \"Flock\":\"%LOCAL_PATH%\\\\Flock\\\\User Data\"} \"gecko_browser_sources\":{\"Mozilla Firefox\":\"%ROAMING_PATH%\\\\Mozilla\\\\Firefox\" \"Waterfox\":\"%ROAMING_PATH%\\\\Waterfox\" \"SeaMonkey\":\"%ROAMING_PATH%\\\\Mozilla\\\\SeaMonkey\" \"Pale Moon\":\"%ROAMING_PATH%\\\\Moonchild Productions\\\\Pale Moon\" \"K-Meleon\":\"%ROAMING_PATH%\\\\K-Meleon\" \"Thunderbird\":\"%ROAMING_PATH%\\\\Thunderbird\" \"IceDragon\":\"%ROAMING_PATH%\\\\Comodo\\\\IceDragon\" \"Cyberfox\":\"%ROAMING_PATH%\\\\8pecxstudios\\\\Cyberfox\" \"BlackHaw\":\"%ROAMING_PATH%\\\\NETGATE Technologies\\\\BlackHaw\"}} \"browser_auths\":{\"enabled\":true \"chromium_sources\":{\"Authenticator: 2FA Client\":\"ocglkepbibnalbgmbachknglpdipeoio\" \"Authenticator\":\"bhghoamapcdpbohphigoooaddinpkbai\" \"Bitwarden Password Manager\":[\"nngceckbapebfimnlniiiahkandclblb\" \"jbkfoedolllekgbhcbcoahefnbanhhlh\"] \"ESET Password Manager\":\"keokhigifjinncljedmendkbikiakicj\" \"GAuth Authenticator\":\"ilgcnhelpchnceeipipijaljkblbcobl\" \"Kaspersky Password Manager\":\"eolheccophlcbnkkbelcgminoojochgj\" \"KeePassHelper Password Manager\":\"bfmglfdehkodoiinbclgoppembjfgjkj\" \"KeePass Tusk\":\"fmhmiaejopepamlcjkncpgpdjichnecm\" \"KeePassXC-Browser\":[\"oboonakemofpalcgghocfoadofidjkkk\" \"pdffhmdngciaglkoonimfcmckehcpafo\"] \"Keeper Password Manager & Digital Vault\":[\"bfogiafebfohielmmehodmfbbebbbpei\" \"lfochlioelphaglamdcakfjemolpichk\"] \"Microsoft Autofill\":\"fiedbfgcleddlbcmgdigjgdfcggjcion\" \"Norton Password Manager\":[\"lcccdlklhahfmobgpnilndimkankpnkg\" \"admmjipmmciaobhojoghlmleefbicajg\"] \"Steam Inventory Helper\":[\"cmeakgjggjdlcpncigglobpjbkabhmjl\" \"klkfekpaenlpkkkflaboioemamggliab\"] \"Trezor Password Manager\":\"imloifkgjagghnncjkhggdhalmcnfklk\"} \"gecko_sources\":{\"KeePassXC-Browser\":\"keepassxc-browser@keepassxc.org\" \"Keeper\":\"KeeperFFStoreExtension@KeeperSecurityInc\"}} \"crypto_wallets\":{\"crypto_wallet_decrypter\":{\"enabled\":true \"configuration\":{\"binance_wallet_processing\":false \"keplr_processing\":true \"magic_eden_wallet_processing\":false \"metamask_processing\":false \"phantom_processing\":false \"rabby_wallet_processing\":false \"ronin_wallet_processing\":false \"tronlink_processing\":false \"trust_wallet_processing\":false}} \"desktop_crypto_wallets\":{\"enabled\":true \"regular_desktop_crypto_wallet_sources\":{\"Armory\":\"%ROAMING_PATH%\\\\Armory\" \"Atomic Wallet\":\"%ROAMING_PATH%\\\\atomic\\\\IndexedDB\\\\file__0.indexeddb.leveldb\" \"Ethereum\":\"%ROAMING_PATH%\\\\Ethereum\\\\keystore\" \"Exodus\":\"%ROAMING_PATH%\\\\Exodus\\\\exodus.wallet\" \"Guarda\":\"%ROAMING_PATH%\\\\Guarda\\\\IndexedDB\\\\https_guarda.co_0.indexeddb.leveldb\" \"Jaxx Liberty\":\"%ROAMING_PATH%\\\\com.liberty.jaxx\\\\IndexedDB\\\\file__0.indexeddb.leveldb\" \"Ledger Wallet\":\"%ROAMING_PATH%\\\\Ledger Live\\\\IndexedDB\\\\file__0.indexeddb.leveldb\" \"OneKey\":\"%ROAMING_PATH%\\\\@onekeyhq\\\\desktop\\\\IndexedDB\" \"Trezor Suite\":\"%ROAMING_PATH%\\\\@trezor\\\\suite-desktop\\\\IndexedDB\\\\file__0.indexeddb.leveldb\" \"Zcash\":\"%ROAMING_PATH%\\\\Zcash\"} \"regular_desktop_crypto_wallet_with_target_file_sources\":{\"Coinomi Wallet\":{\"path\":\"%LOCAL_PATH%\\\\Coinomi\\\\Coinomi\\\\wallets\" \"pattern\":\"*.wallet\"} \"Electrum\":{\"path\":\"%ROAMING_PATH%\\\\Electrum\\\\wallets\" \"pattern\":\"*\"} \"Wasabi Wallet\":{\"path\":\"%ROAMING_PATH%\\\\WalletWasabi\\\\Client\\\\Wallets\" \"pattern\":\"*.json\"} \"Sparrow\":{\"path\":\"%ROAMING_PATH%\\\\Sparrow\\\\wallets\" \"pattern\":\"*.db\"}} \"registry_desktop_crypto_wallet_with_target_file_sources\":{\"Bitcoin Core\":{\"registryPath\":\"Software\\\\Bitcoin\\\\Bitcoin-Qt\" \"registryKey\":\"strDataDir\" \"targetFile\":\"wallet.dat\"} \"Dash Core\":{\"registryPath\":\"Software\\\\Dash\\\\Dash-Qt\" \"registryKey\":\"strDataDir\" \"targetFile\":\"wallet.dat\"} \"Litecoin Core\":{\"registryPath\":\"Software\\\\Litecoin\\\\Litecoin-Qt\" \"registryKey\":\"strDataDir\" \"targetFile\":\"wallet.dat\"} \"Monero\":{\"registryPath\":\"Software\\\\monero-project\\\\monero-core\" \"registryKey\":\"wallet_path\" \"targetFile\":\"*\"}}} \"browser_crypto_wallets\":{\"enabled\":true \"chromium_vault_keystore_extracting\":true \"chromium_sources\":{\"Auro Wallet\":\"cnmamaachppnkjgnildpdmkaakejnhae\" \"Backpack\":\"aflkmfhebedbjioipglgcbcmnbpgliof\" \"Binance Wallet\":\"cadiboklkpojfamcoggejbbdjcoiljjk\" \"Braavos\":\"jnlgamecbpmbajjfhmmmlhejkemejdma\" \"CLV Wallet\":\"nhnkbkgjikgcigadomkphalanndcapjk\" \"Coin98 Wallet Extension\":\"aeachknmefphepccionboohckonoeemg\" \"Coinbase Wallet\":\"hnfanknocfeofbddgcijnmhnfnkdnaad\" \"Crypto.com\":\"hifafgmccdpekplomjjkcfgodnhcellj\" \"EVER Wallet\":\"cgeeodpfagjceefieflmdfphplkenlfk\" \"Enkrypt\":[\"kkpllkodjeloidieedojogacfhpaihoh\" \"gfenajajnjjmmdojhdjmnngomkhlnfjl\" \"dgcgofdhhddbmmpolmgcdofiohgklpkk\"] \"Eternl\":\"kmhcihpebfmpgmihbkipmjlmmioameka\" \"Ethos Sui Wallet\":\"mcbigmjiafegjnnogedioegffbooigli\" \"Exodus Web3 Wallet\":\"aholpfdialjgjfhomihkjbmgjidlcdno\" \"Fewcha Move Wallet\":\"ebfidpplhabeedpnhjnobghokpiioolj\" \"Finnie\":\"cjmkndjhnagcfbpiemnkdpomccnjblmj\" \"Freighter\":\"bcacfldlkkdogcmkkibnjlakofdplcbk\" \"Gero Dashboard\":\"bgpipimickeadkjlklgciifhnalhdjhe\" \"HAVAH Wallet\":\"cnncmdhjacpkmjmkcafchppbnpnhdmon\" \"Hashpak\":\"gjagmgiddbbciopjhllkdnddhcglnemk\" \"KardiaChain Wallet\":\"pdadjkfkgcafgbceimcpbkalnfnepbnk\" \"Keeper Wallet\":\"lpilbniiabackdjcionkobglmddfbcjo\" \"Keplr\":[\"dmkamcknogkgcdfhhbddcghachkejeap\" \"ocodgmmffbkkeecmadcijjhkmeohinei\"] \"Leap Terra Wallet\":\"aijcbedoijmgnlmjeegjaglmepbmpkpi\" \"Liquality Wallet\":\"kpfopkelmapcoipemfendmdcghnegimn\" \"Magic Eden Wallet\":\"mkpegjkblkkefacfnmkajcjmabijhclg\" \"Martian Aptos & Sui Wallet Extension\":\"efbglgofoippbgcjepnhiblaibcnclgk\" \"MathWallet\":[\"afbcbjpbpfadlkmhmclhkeeodmamcflc\" \"dfeccadlilpndjjohbjdblepmjeahlmm\"] \"MetaWallet\":\"kfocnlddfahihoalinnfbnfmopjokmhl\" \"MetaMask\":[\"nkbihfbeogaeaoehlefnkodbefgpgknn\" \"ejbalbakoplchlghecdalmeeeajnimhm\" \"djclckkglechooblngghdinmeemkbgci\"] \"MEW CX\":\"nlbmnnijcnlegkjjpcfjclmcfggfefdm\" \"Morphis Wallet\":\"heefohaffomkkkphnlpohglngmbcclhi\" \"MultiversX Wallet\":\"dngmlblcodfobpdpecaadgfbcggfjfnm\" \"Nami\":\"lpfcbjknijpeeillifnkikgncikgfhdo\" \"OKX Wallet\":\"mcohilncbfahbmgdjkbpemcciiolgcge\" \"Parallel Wallet\":\"kghmdafbipmkhlfgbpdhnlapflnjikno\" \"Petra Aptos Wallet\":\"ejjladinnckdgjemekebdpeokbikhfci\" \"Phantom\":\"bfnaelmomeimhlpmgjnjophhpkkoljpa\" \"Pontem Crypto Wallet\":\"phkbamefinggmakgklpkljjmgibohnba\" \"Rabby Wallet\":\"acmacodkjbdgmoleebolmdjonilkdbch\" \"Ready X\":\"dlcobpjiigpikoobohmabehhmhfoodbb\" \"Ronin Wallet\":\"fnjhmkhhmkbjkkabndcnnogagogbneec\" \"SafePal Extension Wallet\":\"lgmpcpglpngdoalbgeoldeajfclnhafa\" \"Solflare Wallet\":\"bhhhlbepdkbapadjdnnojkbgioiodbic\" \"Slush\":\"opcgpfmipidbgpenhmajoajpbobppdil\" \"Suiet\":\"khpkpbbcccdmmclmpigdgddabeilkdpd\" \"Tonkeeper\":\"omaabbefbmiijedngplfjmnooppbclkk\" \"TronLink\":[\"ibnejdfjmmkpcnlpebklmnkoeoihofec\" \"aheklkkgnmlknpgogcnhkbenfllfcfjb\"] \"Trust Wallet\":\"egjidjbpglichdcondbcbdnbeeppgdph\" \"Venom Wallet\":\"ojggmchlghnjlapmfbnjholfjkiidbch\" \"Ctrl Wallet\":\"hmeobnfnfcmdkdcmlblgagmfpfboieaf\" \"Xverse\":\"idnnbdplmphpflfnlkomgpfbpcgelopg\" \"SecondFi (Yoroi)\":\"ffnbelfdoeiohenkjibnmadjiehjhajb\"} \"gecko_sources\":{\"Keplr\":\"keplr-extension@keplr.app\" \"MetaMask\":\"webextension@metamask.io\" \"Ronin Wallet\":\"ronin-wallet@axieinfinity.com\" \"Tonkeeper\":\"wallet@tonkeeper.com\"}}} \"clipper_module\":{\"enabled\":false \"configuration\":{\"roaming_install_path\":\"\" \"registry_entry_name\":\"\" \"executable_name\":\"\" \"btc_address\":\"\" \"eth_address\":\"\" \"xmr_address\":\"\" \"xrp_address\":\"\" \"bch_address\":\"\" \"doge_address\":\"\" \"dash_address\":\"\" \"trc20_address\":\"\" \"ada_address\":\"\" \"ltc_address\":\"\" \"sol_address\":\"\" \"bnb_address\":\"\"}} \"country_restriction\":{\"enabled\":true \"restricted_countries\":[{\"code\":\"AM\" \"enabled\":true} {\"code\":\"AZ\" \"enabled\":true} {\"code\":\"BY\" \"enabled\":true} {\"code\":\"KZ\" \"enabled\":true} {\"code\":\"KG\" \"enabled\":true} {\"code\":\"RU\" \"enabled\":true} {\"code\":\"TJ\" \"enabled\":true} {\"code\":\"TM\" \"enabled\":true} {\"code\":\"UA\" \"enabled\":true} {\"code\":\"UZ\" \"enabled\":true}]}}","build_id":"minb","city_name":"Baltimore","country_code":"US","country_flag_emoji":"<" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp, "Software\\\o" in Source: 00000000-00005500.00000000.189556.61FF0000.00000004.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksreflect: internal error: invalid use of makeMethodValuestrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= non-empty pointer map passed for non-pointer-size values" in Source: 00000000-00005500.00000001.189818.38DEC000.00000002.mdmp, "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005500.00000001.189818.61FF0000.00000004.mdmp, ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable" in Source: 00000000-00005500.00000001.189818.6202D000.00000004.mdmp, ":\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data" in Source: 00000000-00005500.00000001.189818.6202D000.00000004.mdmp, ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00005500.00000001.189818.6202D000.00000004.mdmp, ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005500.00000001.189818.6202D000.00000004.mdmp, "Software\\\o" in Source: 00000000-00005500.00000001.189818.6208B000.00000004.mdmp41:Tbc7," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a42dfc5d03750799e0c81b7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"Name: RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6a42dfc5d03750799e0c81b7"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"\"ntel(R) PRO/1000 MT Network Connection-WFP Native MAC Layer LightWeight Filter-0000 [00:50:56:91:AF:09]\" (Indicator: \"00:50:56\")\n \"MAC Address 1: Intel(R) PRO/1000 MT Network Connection-WFP Native MAC Layer LightWeight Filter-0000 [00:50:56:91:AF:09]\" (Indicator: \"00:50:56\")\n \"PRO/1000 MT Network Connection-WFP Native MAC Layer LightWeight Filter-0000 [00:50:56:91:AF:09]\" (Indicator: \"00:50:56\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6a42dfc5d03750799e0c81b7"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 140.228.29.111 on port 8080 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a42dfc5d03750799e0c81b7"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin.exe\" connects to 140.228.29.111 on port 8080 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a42dfc5d03750799e0c81b7"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"me: WmiPrvSE.exes\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005500.00000000.189556.61FF0000.00000004.mdmp, 00000000-00005500.00000001.189818.62059000.00000004.mdmp\")\n Found string \"Name: WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005500.00000000.189556.61FF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a42dfc5d03750799e0c81b7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryW\n GetSystemDirectoryA\n GetProcAddress\n LoadLibraryExW\n GetThreadContext\n WriteFile\n VirtualAlloc\n GetSystemInfo\n CreateThread","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a42dfc5d03750799e0c81b7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"a19229094e824540c3a4b1355ab235fac1c84acedcda0f249a2b645f84616360.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a42dfc5d03750799e0c81b7"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"