24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample a3d565152690… — Score 56/100 — Hybrid Analysis","description":"Malicious verdict for sample a3d565152690…. Malware family: Win/malicious_confidence_70%. Threat score 56/100. 6/27 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7"],"about":{"@type":"SoftwareApplication","name":"cx-programmer 9.1 free download full.exe","applicationCategory":["peexe","executable"],"identifier":"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7","additionalType":"Malicious sample"},"threatScore":56,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4bd,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp")26:T59c,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp, 00000000-00001716.00000000.158072.00CC0000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp, 00000000-00001716.00000000.158072.00CC0000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001716.00000000.158072.00CC0000.00000002.mdmp")27:T688d,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile" (Indicator: "CertOpenStore"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found api reference "too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found api reference "too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found api reference "rangebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad index, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panicunexpected g status, g->atomicstatus=bad runtime" (Indicator: "CryptReleaseContext"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverableread-only file systemst" (Indicator: "CertOpenSystemStoreW"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverableread-only file systemst" (Indicator: "CryptAcquireContextW"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found api reference "on: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=4656612873077392578125exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad" (Indicator: "CertGetCertificateChain"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found api reference "profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp" (Indicator: "CertFreeCertificateChain"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125hash of unhashable type: GODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitnotewakeup - double wakeuppersistentalloc: size == 0failed putFast after drainnegative idle mark workersuse of invalid swe" (Indicator: "CertFreeCertificateContext"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin"), Found api reference "epLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free obj" (Indicator: "CertCreateCertificateContext"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin"), Found api reference "ortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin"), Found api reference "ortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverableread-only file systems" (Indicator: "CertOpenSystemStoreW"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverableread-only file systems" (Indicator: "CryptAcquireContextW"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin"), Found api reference "profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625", missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: m" (Indicator: "CertFreeCertificateChain"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125hash of unhashable type: GODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitnotewakeup - double wakeuppersistentalloc: size == 0failed putFast after drainnegative idle mark workersuse of invalid sw" (Indicator: "CertFreeCertificateContext"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free ob" (Indicator: "CertCreateCertificateContext"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin"), Found api reference "runtime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp"), Found api reference " locked to thread synctest bubble runtime.semacreateruntime.semawakeup298023223876953125value out of rangebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad index gp->atomicstatus=marking free object KiB work (eager) [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp"), Found api reference "exit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") Found api reference "unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") Found api reference "unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp")28:Tfd2,Found XOR loop in file "sample.bin" at offset 105993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 989019; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 991855; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1442775; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1471159; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1576295; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1808792; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1816260; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1853256; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1916292; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2089917; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2097017; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2108099; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2111865; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2113947; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2114289; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2115917; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2116343; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2120979; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2130232; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2311812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2314878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1142992; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1422026; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2108855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2110821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 47934; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 151912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 152227; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 152271; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 153417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 153519; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 200933; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254154; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 255262; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 255314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 257674; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 257726; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1047040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1079772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1084080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1280034; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1356661; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1651047; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1811900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2068228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2077792; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2090680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2111368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2112888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2113940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2119308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2120960; code bytes = 803029:T9f2,"" (Indicator: "GetDC"; Source: "00000000-00001716.00000000.158072.007F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001716.00000000.158072.007F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001716.00000000.158072.007F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001716.00000000.158072.007F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001716.00000000.158072.007F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001716.00000000.158072.007F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001716.00000000.158072.007F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001716.00000000.158072.007F0000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00001716.00000000.158072.04F60000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001716.00000000.158072.04F60000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001716.00000000.158072.04F60000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001716.00000000.158072.04F60000.00000040.mdmp")35:T632,file/memory contains long string with (Indicator: "GetUserName"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp")36:Te61,Found string "chacha8" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "aes"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "internal/chacha8rand.setup" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "internal/chacha8rand.block_generic" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "internal/chacha8rand.qr" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "aeshashbody" (Indicator: "aes"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "internal/chacha8rand/chacha8_generic.go" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "internal/chacha8rand/chacha8_stub.s" (Indicator: "chacha"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "runtime.useAeshash" (Indicator: "aes"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "runtime.aeskeysched" (Indicator: "aes"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found string "chacha8" (Indicator: "chacha"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") Found string "*chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") Found string "internal/chacha8rand" (Indicator: "chacha"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") Found string "pc= G125625NaNadxaesshaavxfmabindboolint8uintchanfuncallgallprootitabsbrkidledeadsync is LEAFheapbase at Has of ) = <==GOGC] = pc=true: p=cas1cas2cas3cas4cas5cas6" (Indicator: "aes"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp, 00000000-00001716.00000000.158072.00CC0000.00000002.mdmp")37:T657,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "Process32First"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001716.00000000.158072.04F60000.00000040.mdmp")38:T5bd,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "GetProcAddress"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "GetProcAddress"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp, 00000000-00001716.00000000.158072.00CC0000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp, 00000000-00001716.00000000.158072.00CC0000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001716.00000000.158072.00CC0000.00000002.mdmp")39:T4ab,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "00000000-00001716.00000000.158072.00B95000.00000002.mdmp")3a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A9wAAAAAAAAAAAAAAAAAAf/cAAAAAAAAAAAAAAAAAAH/3AAAAAAAAAAAAAAAAAAB/+FVVd3d3d3d3dQAAAAAAf/jd2IiIiIiIiIdQAAAAAH/43diIiIiIiIiId3d3dwB/+N3YiIiIiIiIiIiIiIhwf/jd2IiIiIiIiIiIiIiIcH/43diIiIiIiIiIiIiIiHB/+N3YiIiIiIiIiIiIiIhwf/jd2IiIiIiIiIiIiIiIcH/43diIeIiIiIiIiIiIiHB/+NiIh1V9iIiIiIjdiIhwf/h3d3dViIiIiIiIjYiIcH/3AAAFWIiIiIiIiIiIiFB/9wAABYiIiI+IiIiIiIdQf/cABXiIiIiIiIiIiIhwAH/3AAV4iNiIiIiIiIiIcAB/9wAABd3diIiIiIiIiFAAf/cAAAV93YiIiIiIiIdQAH/3AAAFfd2IiIiIiHVVAAB/9wAABX3diIiIiIhQAAAAf/cAAAV93YiIiIiIUAAAAH/3AAAFfd2IiIiIiFAAAAB/9wAABX3diIiIiIhQAAAAf/cAAAV92IiIiIiIUAAAAH/3AAAFfdiIiIiIiFAAAAB/9wAABXiIiIiIiIhQAAAAf/cAAABVVVVXiHd3AAAAAH/3AAAAAAAAAHdQAAAAAAB/9wAAAAAAAABVAAAAAAAAf/cAAAAAAAAAAAAAAAAAAH//////////////////////wAAP/8AAD//AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AwAAPwMAAD/8AAA//AAAP/AAAP/wAAD//AAA//wAAP/8AA///AAP//wAD//8AA///wAP//8AD///AA///wAP//////////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":56,"unified_at_epoch_ms":1790788307317,"unified_at":"2026-09-30T17:11:47.317Z","metadata":{"hashes":{"sha256":"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7","sha1":"999efe2b1a3f7d15e38395387cc13d2ebd5718a7","md5":"5ac1f7bb6b5280f344bd10d1be424a94","sha512":"fe9534ec93c2fd96b7038f55e0ed08d5425d84f4c6d0dc0e77b616742e362b057f60fb60e77eac4e413b746cf385b563f9c626013f6e6a2b246e7b3b52c9ab53","ssdeep":"24576:V5uJ/YW5d6NwLb3ezR/a4qkYDYhDEneNUUKlIA5+OQRvXGiDvIhAOPGvKlyMCfdO:V2zoh9JSqXfKyKHJvnoE7okxlEJ","ssdeep_chunks":["24576:V5uJ/YW","24576:5uJ/YW5","24576:uJ/YW5d","24576:J/YW5d6","24576:/YW5d6N","24576:YW5d6Nw","24576:W5d6NwL","24576:5d6NwLb","24576:d6NwLb3","24576:6NwLb3e","24576:NwLb3ez","24576:wLb3ezR","24576:Lb3ezR/","24576:b3ezR/a","24576:3ezR/a4","24576:ezR/a4q","24576:zR/a4qk","24576:R/a4qkY","24576:/a4qkYD","24576:a4qkYDY","24576:4qkYDYh","24576:qkYDYhD","24576:kYDYhDE","24576:YDYhDEn","24576:DYhDEne","24576:YhDEneN","24576:hDEneNU","24576:DEneNUU","24576:EneNUUK","24576:neNUUKl","24576:eNUUKlI","24576:NUUKlIA","24576:UUKlIA5","24576:UKlIA5+","24576:KlIA5+O","24576:lIA5+OQ","24576:IA5+OQR","24576:A5+OQRv","24576:5+OQRvX","24576:+OQRvXG","24576:OQRvXGi","24576:QRvXGiD","24576:RvXGiDv","24576:vXGiDvI","24576:XGiDvIh","24576:GiDvIhA","24576:iDvIhAO","24576:DvIhAOP","24576:vIhAOPG","24576:IhAOPGv","24576:hAOPGvK","24576:AOPGvKl","24576:OPGvKly","24576:PGvKlyM","24576:GvKlyMC","24576:vKlyMCf","24576:KlyMCfd","24576:lyMCfdO","49152:V5uJ/YW","49152:5uJ/YW5","49152:uJ/YW5d","49152:J/YW5d6","49152:/YW5d6N","49152:YW5d6Nw","49152:W5d6NwL","49152:5d6NwLb","49152:d6NwLb3","49152:6NwLb3e","49152:NwLb3ez","49152:wLb3ezR","49152:Lb3ezR/","49152:b3ezR/a","49152:3ezR/a4","49152:ezR/a4q","49152:zR/a4qk","49152:R/a4qkY","49152:/a4qkYD","49152:a4qkYDY","49152:4qkYDYh","49152:qkYDYhD","49152:kYDYhDE","49152:YDYhDEn","49152:DYhDEne","49152:YhDEneN","49152:hDEneNU","49152:DEneNUU","49152:EneNUUK","49152:neNUUKl","49152:eNUUKlI","49152:NUUKlIA","49152:UUKlIA5","49152:UKlIA5+","49152:KlIA5+O","49152:lIA5+OQ","49152:IA5+OQR","49152:A5+OQRv","49152:5+OQRvX","49152:+OQRvXG","49152:OQRvXGi","49152:QRvXGiD","49152:RvXGiDv","49152:vXGiDvI","49152:XGiDvIh","49152:GiDvIhA","49152:iDvIhAO","49152:DvIhAOP","49152:vIhAOPG","49152:IhAOPGv","49152:hAOPGvK","49152:AOPGvKl","49152:OPGvKly","49152:PGvKlyM","49152:GvKlyMC","49152:vKlyMCf","49152:KlyMCfd","49152:lyMCfdO","24576:V2zoh9J","24576:2zoh9JS","24576:zoh9JSq","24576:oh9JSqX","24576:h9JSqXf","24576:9JSqXfK","24576:JSqXfKy","24576:SqXfKyK","24576:qXfKyKH","24576:XfKyKHJ","24576:fKyKHJv","24576:KyKHJvn","24576:yKHJvno","24576:KHJvnoE","24576:HJvnoE7","24576:JvnoE7o","24576:vnoE7ok","24576:noE7okx","24576:oE7okxl","24576:E7okxlE","24576:7okxlEJ"],"imphash":"5af915f278815e76bad476ef32593028"},"file_info":{"file_name":"cx-programmer 9.1 free download full.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2335232,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1777482955000,"last_seen":1777483032000,"last_multi_scan":1777483032000}},"detections":{"summary":{"verdict":"malicious","score":56,"tags":null},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":53},"sandbox_signatures":{"informative_count":108,"suspicious_count":10,"malicious_count":0,"total":118},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Infostealer/Win.ACRStealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/TrojanDropper.Agent.EK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Suspicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; Source: \"00000000-00001716.00000000.158072.00B95000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001716.00000000.158072.04F60000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001716.00000000.158072.00B95000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001716.00000000.158072.007F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; File: \"a3d5651526901f3b2752ec485b840b8dc5cc4fce872d5c19d795be9be255fde7.bin\")\n Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; Source: \"00000000-00001716.00000000.158072.00CC0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001716.00000000.158072.00B95000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001716.00000000.158072.04F60000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001716.00000000.158072.007F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69f23d17db7acc4057010115"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"