24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample bac12c7b2bc0… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample bac12c7b2bc0…. Malware family: Win/malicious_confidence_70%. Threat score 86/100. 2/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773"],"about":{"@type":"SoftwareApplication","name":"bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4f6,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin")26:T40b,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin")27:T6ab,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg" (Indicator: "CertOpenStore"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found api reference "ixmynergfpbymimin_voltage_kvstranded_ticksfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #internal errorasynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found api reference "ixmynergfpbymimin_voltage_kvstranded_ticksfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #internal errorasynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found api reference "but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupreflect.Value.Elemreflect.Value.Type298023223876953125GetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.Floatafter array elementEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk S" (Indicator: "CryptReleaseContext"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found api reference "(JSON):invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goreflect.Value.IsZero3725290298461914" (Indicator: "CertOpenSystemStoreW"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found api reference "(JSON):invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goreflect.Value.IsZero3725290298461914" (Indicator: "CryptAcquireContextW"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found api reference "intgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free space/gc/scan/globals:bytes/gc/heap/frees:objectsruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=unexpected method step4656612873077392578125RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResult%SystemRoot%\system32\exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too largeunexpected map key typeE. Africa Standard TimeTocantins Standard TimeArgentina Standa" (Indicator: "CertGetCertificateChain"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found api reference "-%d%sconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWjson: unsupported type: SA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard Timetracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime:" (Indicator: "CertFreeCertificateChain"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexunexpected key value typeExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleencountered a cycle via %sSouth Africa Standard T" (Indicator: "CertFreeCertificateContext"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin"), Found api reference "(Value): channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreafter object key:value pairEaster Island Standard TimePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type 363797880709171295166015625abi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#$" (Indicator: "CertCreateCertificateContext"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin"), Found api reference ":resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin"), Found api reference ":resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxch" (Indicator: "CertOpenStore"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found api reference "but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupreflect.Value.Elemreflect.Value.Type298023223876953125GetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.Floatafter array elementEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk" (Indicator: "CryptReleaseContext"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found api reference "(JSON):invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goreflect.Value.IsZero372529029846191" (Indicator: "CertOpenSystemStoreW"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found api reference "(JSON):invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goreflect.Value.IsZero372529029846191" (Indicator: "CryptAcquireContextW"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found api reference "intgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free space/gc/scan/globals:bytes/gc/heap/frees:objectsruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=unexpected method step4656612873077392578125RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResult%SystemRoot%\system32\exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too largeunexpected map key typeE. Africa Standard TimeTocantins Standard TimeArgentina Stand" (Indicator: "CertGetCertificateChain"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexunexpected key value typeExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleencountered a cycle via %sSouth Africa Standard" (Indicator: "CertFreeCertificateContext"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type 363797880709171295166015625abi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#" (Indicator: "CertCreateCertificateContext"; File: "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin")2a:T680,Observed string: "64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddress" (Indicator: "64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddress") in Source: bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin Observed string: "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=unexpected EOFunsafe.Pointer on zero Valueunknown methodinvalid syntax1907348632812595367431640625OpenSCManagerWModule32FirstWunreachable: RegSetValueExWcrypto/fips140mime/multipartx509sha256skid" (Indicator: "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=unexpected EOFunsafe.Pointer on zero Valueunknown methodinvalid syntax1907348632812595367431640625OpenSCManagerWModule32FirstWunreachable: RegSetValueExWcrypto/fips140mime/multipartx509sha256skid") in Source: bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin2b:T1a04,Contains base64 string in header "Keep" in header "GET /af97ri HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "Encoding" in header "GET /af97ri HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "gzip" in header "GET /af97ri HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "Language" in header "GET /af97ri HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "telegram" in header "GET /af97ri HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----77283ced7ded3f08becfAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: iii.psgiran.news" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----77283ced7ded3f08becfAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: iii.psgiran.news" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----77283ced7ded3f08becfAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: iii.psgiran.news" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----77283ced7ded3f08becfAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: iii.psgiran.news" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----77283ced7ded3f08becfAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: iii.psgiran.news" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----77283ced7ded3f08becfAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: iii.psgiran.news" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----77283ced7ded3f08becfAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: iii.psgiran.news" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----77283ced7ded3f08becfAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: iii.psgiran.news" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----77283ced7ded3f08becfAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: iii.psgiran.news" Contains base64 string in header "news" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----77283ced7ded3f08becfAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: iii.psgiran.news"2c:T32cf,Found XOR loop in file "sample.bin" at offset 95058; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 188028; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1002413; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1375801; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1560427; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1632935; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1736763; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1746076; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1757340; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1781747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1785308; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1790887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1826215; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1838812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1841575; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1895155; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1943207; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1976220; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2021532; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2039196; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2041651; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2044060; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2053031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2090919; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2112924; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2140060; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2153884; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2162707; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2172316; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2180508; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2185628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2189980; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2196019; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2218407; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2228700; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2241692; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2265255; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2272563; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2284444; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2289820; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2312871; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2341020; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2351516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2355367; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2362023; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2428467; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2449820; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2455207; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2510236; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2511516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2525852; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2531635; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2583275; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2583470; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2965609; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3390936; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3390984; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3391980; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3392136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3392196; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3392448; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3392880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3393612; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3394308; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3395136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3395244; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3395616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3397332; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3397872; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3398340; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3398388; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3398616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3399084; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3399360; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3399372; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3399624; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3400236; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3400320; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3400344; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3400656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3401160; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3401208; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3401532; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3401544; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3403152; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3403344; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3404880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3405624; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3406284; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3406296; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3406320; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3406608; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3406740; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3406776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3407004; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3407064; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3407148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3407196; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3407712; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3407760; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3407772; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3407832; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3407952; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3408108; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3408144; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3408156; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3408252; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3408420; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3408456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3408516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3409332; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3410004; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3410076; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3410796; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3410844; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3410964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3411048; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3411612; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3411636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3411648; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3411660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3411672; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3411696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3411720; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3411732; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3411768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3412368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3412524; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3412608; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3484050; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1617544; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1710744; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1722710; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3038501; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 191670; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229841; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 230241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 232403; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254833; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 274960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418149; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419486; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 429865; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 500295; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1317976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1516352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1540336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1540344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1540440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1540448; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1540480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1540488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1540576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1540584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1540608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1540616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1542720; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1542768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1542848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1542912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1542992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1543056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1543144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1787795; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1834463; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1966995; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2106591; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2228883; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2243475; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2331261; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2359699; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2805428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3153252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3275828; code bytes = 80302d:T469,Found system information discovery API: "GetEnvironmentStringsW" in file "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin" Found system information discovery API: "GetSystemInfo" in file "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in file "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin" Found system information discovery API: "internal/syscall/windows/registry.procExpandEnvironmentStringsW" in file "bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin"2e:T9f2," HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Sat 27 Jun 2026 14:19:11 GMT Content-Type: text/html; charset=utf-8 Content-Length: 4419 Connection: keep-alive Set-Cookie: stel_ssid=59449c1a13ff44dd72_1817631704643936979; expires=Sun 28 Jun 2026 14:19:11 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C.......34:T8b5," "------77283ced7ded3f08becfContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-13856D6------77283ced7ded3f08becfContent-Disposition: form-data; name="build_id"7d45f487e313415bc029cfc0df17fca2------77283ced7ded3f08becfContent-Disposition: form-data; name="format"json------77283ced7ded3f08becf--" HTTP/1.1 200 OK Date: Sat 27 Jun 2026 14:19:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=11 cfOrigin;dur=817 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nbxuJUgbLO1qEINXOOyCo%2BXqN0rtqs2RkvJz8aUFa3b%2BEKDyxnzXsr%2F5yaiGuNUHF8FB0ZBOaV9BFSH5T6iBi12pq%2F0xxq9X%2BNbgaHyaKtgyZzV5unAKTrChXu2ll2PKIuNy"}]} Content-Encoding: gzip CF-RAY: a12515d3586e235c-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B.......45:Td0c,"status is not in scan state is currently not supported for use in system callbacksreflect: internal error: invalid use of makeMethodValue\" in Source: bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin\" has section name .rdata with entropy \"7.1119835444463995\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\" \"------77283ced7ded3f08becfContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-13856D6------77283ced7ded3f08becfContent-Disposition: form-data; name=\"build_id\"7d45f487e313415bc029cfc0df17fca2------77283ced7ded3f08becfContent-Disposition: form-data; name=\"format\"json------77283ced7ded3f08becf--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":51,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":33,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":33,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","suspicious","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6a3fdbc3e37823ba8100fda4","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":86,"malware_family":"W64.Evo","contacted_countries":["GBR"],"submit_name":"bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin","analysis_start_time":"2026-06-27T14:18:44+00:00","indicators_count":{"informative":147,"suspicious":27,"malicious":2},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"address":"172.67.175.210","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]}],"dns_resolutions":[{"domain":"iii.psgiran.news","address":"172.67.175.210","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"domain":"telegram.me","address":"149.154.167.99","ttl":200,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]}],"http_requests":[{"host":"telegram.me","host_ip":"149.154.167.99:443","url":"/af97ri","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /af97ri HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0\nHost: telegram.me","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"host":"iii.psgiran.news","host_ip":"172.67.175.210:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----77283ced7ded3f08becf\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0\nContent-Length: 345\nHost: iii.psgiran.news","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}],"processes":[{"pid":3568,"ppid":0,"name":"bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin.exe","command_line":"","sha256":"bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773","normalized_path":"C:\\bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773.bin.exe","uid":"00000000-00003568","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["VxSSL64.dll","bcryptprimitives.dll","oleaut32.dll","winmmbase.dll","webio.dll","IPHLPAPI.DLL","crypt32.dll","fltLib.dll","gdi32.dll","combase.dll","winhttp.dll","sspicli.dll","dnsapi.dll","ntdll.dll","KernelBase.dll","rasadhlp.dll","ncrypt.dll","gpapi.dll","ws2_32.dll","ole32.dll","imm32.dll","winnsi.dll","mskeyprotect.dll","dpapi.dll","ucrtbase.dll","sechost.dll","FWPUCLNT.DLL","msasn1.dll","ntasn1.dll","user32.dll","msvcp_win.dll","shlwapi.dll","winmm.dll","bcrypt.dll","nsi.dll","ncryptsslp.dll","rsaenh.dll","kernel32.dll","win32u.dll","gdi32full.dll","msvcrt.dll","cfgmgr32.dll","powrprof.dll","schannel.dll","cryptbase.dll","rpcrt4.dll","advapi32.dll","cryptsp.dll","OnDemandConnRouteHelper.dll","mswsock.dll","apphelp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]},{"name":"Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a3fdbc3e37823ba8100fda4"}]}]}},"report_ids":{"sandbox_job_ids":["6a3fdbc3e37823ba8100fda4"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample bac12c7b2bc0… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bac12c7b2bc0…. Malware family: Win/malicious_confidence_70%. Threat score 86/100. 2/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample bac12c7b2bc0… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bac12c7b2bc0…. Malware family: Win/malicious_confidence_70%. Threat score 86/100. 2/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bac12c7b2bc08d4d552e4692bc1566d7d54efc67c3a1131628c491c23626d773"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample bac12c7b2bc0… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bac12c7b2bc0…. Malware family: Win/malicious_confidence_70%. Threat score 86/100. 2/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L48","11",{}]]