26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 43:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample c23ababf9ec4… — Score 82/100 — Hybrid Analysis","description":"Malicious verdict for sample c23ababf9ec4…. Malware family: Win/malicious_confidence_90%. Threat score 82/100. 4/27 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5"],"about":{"@type":"SoftwareApplication","name":"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5","additionalType":"Malicious sample"},"threatScore":82,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8b7,Found string - tremove390625SundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect not object objs next= jobs= goid sweep B -> % util alloc free span= prev= list= i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base CommonrdtscppopcntGetACP Valueuint16uint32uint64stringstructcmd/gonetdnsftsmozncqknaxmxcdrjsjbaufjrnmwuvnrirxbcjvzzgfsoynnsyooppjggmxeryfcobhyqzxqfylaioednhexlezumtmekcznvxpsjpkCopySidWSARecvWSASendconnectreaddirconsole19531259765625TuesdayJanuaryOctoberMUI_StdMUI_DltforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil (scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: GODEBUG nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type avx512f\\.\UNCSwapperinvaliduintptrfloat32float64runtimeos/execfips140tls3destlssha1Gs-alphasabburhejyvhyxctzksheetfzwggnqadno anodeCancelIoReadFileAcceptExWSAIoctlshutdown48828125infinitystrconv.pa; Source: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found string - tremove390625SundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect not object objs next= jobs= goid sweep B -> % util alloc free span= prev= list= i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base CommonrdtscppopcntGetACP Valueuint16uint32uint64stringstructcmd/gonetdnsftsmozncqknaxmxcdrjsjbaufjrnmwuvnrirxbcjvzzgfsoynnsyooppjggmxeryfcobhyqzxqfylaioednhexlezumtmekcznvxpsjpkCopySidWSARecvWSASendconnectreaddirconsole19531259765625TuesdayJanuaryOctoberMUI_StdMUI_DltforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil (scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: GODEBUG nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type avx512f\\.\UNCSwapperinvaliduintptrfloat32float64runtimeos/execfips140tls3destlssha1Gs-alphasabburhejyvhyxctzksheetfzwggnqadno anodeCancelIoReadFileAcceptExWSAIoctlshutdown48828125infinitystrconv.p; Source: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin")28:T7f7,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmexbxced->cAMPjpzdugn->cAMPqqlnluhjjzdlmibkvyhh->cAMPuvmybeqzldkdrmkvzxii->cAMPseczmig->cAMPtmyahefhivolzpyvidxlhfdpmnnrbpggpfsmbzsmmkhptwkyzequjqbixxz->cAMPczmgllqfoipkzjmdyhyzthoktwaiydourprkmtfnahpdjjlizshpehmaigd->cAMPezzadbhwyycdqfsyvipx->cAMPyaotlertsgnchxgdafjzrkluuejccdhbpukuxrxdwpavuv->cAMPbftvcfr->cAMPhomjtmcxhjeuxpnpeyapgskymgcgkjzcnyxepuhlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625invalid base wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waito" (Indicator: "CertOpenStore"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "enRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unexpected EOFinvalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "ibdrpqaadenylyl-gibdrpqa-Vcblcsybx-adrenergicspilutsa-adrenergicG-protein->itqbulpuylrokgge-adrenergicadenylyl-itqbulpu-Vmwrbocyk-adrenergicG-protein->kluzgrkdadenylyl-kluzgrkd-Vxfljbsmj-adrenergicycftndupnltbl->cAMPG-protein->skjiifikadenylyl-skjiifik-Vbkwprfyvsclml->cAMPG-protein->qkgqlswsadenylyl-qkgqlsws-Vncehaijk-adrenergicyscgqzlayopei->cAMPlrqaqpuw-adrenergicG-protein->hitsuxzxadenylyl-hitsuxzx-VG-protein->svortkhpadenylyl-svortkhp-Vmnafhccldeqyu->cAMPnzwrceod-adrenergicG-protein->eivucgtbadenylyl-eivucgtb-Vphzhwmih-adrenergicG-protein->dcdhzijkadenylyl-dcdhzijk-VG-protein->dqogszxmadenylyl-dqogszxm-VG-protein->piekwqfzadenylyl-piekwqfz-VG-protein->iepwoxdyadenylyl-iepwoxdy-Vweggjgtafubsj->cAMPomastjvb-adrenergicbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125Egypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Stan" (Indicator: "CryptReleaseContext"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "ergicinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write result37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goGetAdaptersAddresse" (Indicator: "CertOpenSystemStoreW"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "ergicinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write result37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goGetAdaptersAddresse" (Indicator: "CryptAcquireContextW"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "entBlockWSAGetOverlappedResult%SystemRoot%\system32\exit hook invoked exitG-protein->lrsxqxxnftamadenylyl-lrsxqxxnftam-VG-protein->pppqfyrzcyzgadenylyl-pppqfyrzcyzg-VG-protein->ddwlvtmzbrhcvsxplpqyzdor-adrenergicadenylyl-ddwlvtmzbrhc-Vrjimlibmdlqd-adrenergicG-protein->ugqprzbpdkmiadenylyl-ugqprzbpdkmi-VG-protein->qzhadudrxxwjadenylyl-qzhadudrxxwj-VG-protein->wqbxuuqyjdipadenylyl-wqbxuuqyjdip-VG-protein->jxvtihvuemqeadenylyl-jxvtihvuemqe-VG-protein->nhwlzqrrvacoadenylyl-nhwlzqrrvaco-Vjpgwckqjlkyk-adrenergicG-protein->xheegofwgehcadenylyl-xheegofwgehc-Vdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too large23283064365386962890625E. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapo" (Indicator: "CertGetCertificateChain"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "anicpattern bits too long: G-protein->ycftndupnltbladenylyl-ycftndupnltbl-VG-protein->bkwprfyvsclmladenylyl-bkwprfyvsclml-Vxidqflyydmfqi-adrenergicG-protein->yscgqzlayopeiadenylyl-yscgqzlayopei-Vbvnhxpvisxtwf-adrenergicG-protein->mnafhccldeqyuadenylyl-mnafhccldeqyu-Vfgcrvqphlldqz-adrenergicoftgdavojmvrr-adrenergicahlbusvtrlbpy-adrenergiceqgvudrdtsqtr-adrenergicsgkibuvwrjdpj-adrenergicG-protein->weggjgtafubsjadenylyl-weggjgtafubsj-Vconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625SA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard Timetracechecksta" (Indicator: "CertFreeCertificateChain"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "ya-Vhengmthqvaoftac-adrenergicG-protein->mxmelnsjzmrfbxpadenylyl-mxmelnsjzmrfbxp-Vqngrmusxbheqbfu-adrenergicobfettanvfjwtwh-adrenergicxecxtxuovvtjuly-adrenergicxxusrqmcqhkjsbl-adrenergicqsbwiyugagbathd-adrenergicinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int63ninvalid argument to Int31n1455191522836685180664062572759576141834259033203125South Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of" (Indicator: "CertFreeCertificateContext"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStore363797880709171295166015625Easter Island Standard TimePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625Canada Central Standard Tim" (Indicator: "CertCreateCertificateContext"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "und unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: tried to fill full buffer28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max p" (Indicator: "CertAddCertificateContextToStore"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "und unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: tried to fill full buffer28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max p" (Indicator: "CertVerifyCertificateChainPolicy"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmexbxced->cAMPjpzdugn->cAMPqqlnluhjjzdlmibkvyhh->cAMPuvmybeqzldkdrmkvzxii->cAMPseczmig->cAMPtmyahefhivolzpyvidxlhfdpmnnrbpggpfsmbzsmmkhptwkyzequjqbixxz->cAMPczmgllqfoipkzjmdyhyzthoktwaiydourprkmtfnahpdjjlizshpehmaigd->cAMPezzadbhwyycdqfsyvipx->cAMPyaotlertsgnchxgdafjzrkluuejccdhbpukuxrxdwpavuv->cAMPbftvcfr->cAMPhomjtmcxhjeuxpnpeyapgskymgcgkjzcnyxepuhlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625invalid base wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Wait" (Indicator: "CertOpenStore"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "ibdrpqaadenylyl-gibdrpqa-Vcblcsybx-adrenergicspilutsa-adrenergicG-protein->itqbulpuylrokgge-adrenergicadenylyl-itqbulpu-Vmwrbocyk-adrenergicG-protein->kluzgrkdadenylyl-kluzgrkd-Vxfljbsmj-adrenergicycftndupnltbl->cAMPG-protein->skjiifikadenylyl-skjiifik-Vbkwprfyvsclml->cAMPG-protein->qkgqlswsadenylyl-qkgqlsws-Vncehaijk-adrenergicyscgqzlayopei->cAMPlrqaqpuw-adrenergicG-protein->hitsuxzxadenylyl-hitsuxzx-VG-protein->svortkhpadenylyl-svortkhp-Vmnafhccldeqyu->cAMPnzwrceod-adrenergicG-protein->eivucgtbadenylyl-eivucgtb-Vphzhwmih-adrenergicG-protein->dcdhzijkadenylyl-dcdhzijk-VG-protein->dqogszxmadenylyl-dqogszxm-VG-protein->piekwqfzadenylyl-piekwqfz-VG-protein->iepwoxdyadenylyl-iepwoxdy-Vweggjgtafubsj->cAMPomastjvb-adrenergicbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125Egypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Sta" (Indicator: "CryptReleaseContext"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "ergicinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write result37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goGetAdaptersAddress" (Indicator: "CertOpenSystemStoreW"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "ergicinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write result37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goGetAdaptersAddress" (Indicator: "CryptAcquireContextW"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "entBlockWSAGetOverlappedResult%SystemRoot%\system32\exit hook invoked exitG-protein->lrsxqxxnftamadenylyl-lrsxqxxnftam-VG-protein->pppqfyrzcyzgadenylyl-pppqfyrzcyzg-VG-protein->ddwlvtmzbrhcvsxplpqyzdor-adrenergicadenylyl-ddwlvtmzbrhc-Vrjimlibmdlqd-adrenergicG-protein->ugqprzbpdkmiadenylyl-ugqprzbpdkmi-VG-protein->qzhadudrxxwjadenylyl-qzhadudrxxwj-VG-protein->wqbxuuqyjdipadenylyl-wqbxuuqyjdip-VG-protein->jxvtihvuemqeadenylyl-jxvtihvuemqe-VG-protein->nhwlzqrrvacoadenylyl-nhwlzqrrvaco-Vjpgwckqjlkyk-adrenergicG-protein->xheegofwgehcadenylyl-xheegofwgehc-Vdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too large23283064365386962890625E. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingap" (Indicator: "CertGetCertificateChain"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "anicpattern bits too long: G-protein->ycftndupnltbladenylyl-ycftndupnltbl-VG-protein->bkwprfyvsclmladenylyl-bkwprfyvsclml-Vxidqflyydmfqi-adrenergicG-protein->yscgqzlayopeiadenylyl-yscgqzlayopei-Vbvnhxpvisxtwf-adrenergicG-protein->mnafhccldeqyuadenylyl-mnafhccldeqyu-Vfgcrvqphlldqz-adrenergicoftgdavojmvrr-adrenergicahlbusvtrlbpy-adrenergiceqgvudrdtsqtr-adrenergicsgkibuvwrjdpj-adrenergicG-protein->weggjgtafubsjadenylyl-weggjgtafubsj-Vconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625SA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard Timetracecheckst" (Indicator: "CertFreeCertificateChain"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "ya-Vhengmthqvaoftac-adrenergicG-protein->mxmelnsjzmrfbxpadenylyl-mxmelnsjzmrfbxp-Vqngrmusxbheqbfu-adrenergicobfettanvfjwtwh-adrenergicxecxtxuovvtjuly-adrenergicxxusrqmcqhkjsbl-adrenergicqsbwiyugagbathd-adrenergicinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int63ninvalid argument to Int31n1455191522836685180664062572759576141834259033203125South Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse o" (Indicator: "CertFreeCertificateContext"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625Canada Central Standard Ti" (Indicator: "CertCreateCertificateContext"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "und unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: tried to fill full buffer28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max" (Indicator: "CertAddCertificateContextToStore"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin") Found api reference "und unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: tried to fill full buffer28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max" (Indicator: "CertVerifyCertificateChainPolicy"; File: "c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin")2b:T1848,Contains base64 string in header "Keep" in header "GET /d77xtr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "Encoding" in header "GET /d77xtr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "gzip" in header "GET /d77xtr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "Language" in header "GET /d77xtr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "telegram" in header "GET /d77xtr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c4c2184fdc680f2c8bb4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: pas.firesupport.com" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c4c2184fdc680f2c8bb4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: pas.firesupport.com" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c4c2184fdc680f2c8bb4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: pas.firesupport.com" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c4c2184fdc680f2c8bb4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: pas.firesupport.com" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c4c2184fdc680f2c8bb4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: pas.firesupport.com" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c4c2184fdc680f2c8bb4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: pas.firesupport.com" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c4c2184fdc680f2c8bb4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: pas.firesupport.com" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c4c2184fdc680f2c8bb4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: pas.firesupport.com" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c4c2184fdc680f2c8bb4Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: pas.firesupport.com"2c:T1143,Found XOR loop in file "sample.bin" at offset 88146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 902168; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1225874; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2614456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2820588; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1242204; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1243868; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1252572; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1252588; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1252684; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1252716; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1252812; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1252828; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1252956; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1252972; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1253068; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1253100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1253196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1253212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1534748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1862236; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1869420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1886796; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1907676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1909212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1912684; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1967852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1973740; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1977452; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2024812; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2257900; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2258892; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2281292; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2293708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2294732; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 184758; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 222569; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 222929; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 223329; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 225491; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 247985; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 268112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411109; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411805; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 412446; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 422825; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 655983; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 656018; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 870896; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 911064; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 918288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1230452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1253667; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1576075; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2234979; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2455221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2703240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2745424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2786360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3000638; code bytes = 80302d:T9f2,"status is not in scan state is currently not supported for use in system callbacksfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= runtime: checkmarks found unexpected unmarked object obj=bufio.Scanner: SplitFunc returns advance count beyond inputtried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: PostQueuedCompletionStatus fa" in Source: c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin "for done generationtrace: non-empty full trace buffer for next generationgoroutine running on other thread; stack unavailablebufio.Scanner: SplitFunc returns negative advance countSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= runtime: checkmarks found unexpected unmarked object obj=bufio.Scanner: SplitFunc returns advance count beyond inputtried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: PostQueuedCompletionStatus f" in Source: c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin33:T40a,"GET /d77xtr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Sun 07 Jun 2026 13:04:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 4423 Connection: keep-alive Set-Cookie: stel_ssid=b0050b1d273261fed2_378576286534817862; expires=Mon 08 Jun 2026 13:04:01 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C.......34:T8b5," "------c4c2184fdc680f2c8bb4Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-1EE9E36------c4c2184fdc680f2c8bb4Content-Disposition: form-data; name="build_id"4ac2e1273ffc025e8f19d4c61a21acfa------c4c2184fdc680f2c8bb4Content-Disposition: form-data; name="format"json------c4c2184fdc680f2c8bb4--" HTTP/1.1 200 OK Date: Sun 07 Jun 2026 13:04:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=HnIrfgyNk6Qlh3eBQsu5gyPLRk8%2B4e7QPJhSDx8WBYy59gh6281wlG%2BvnGLU1r8sNgEsHZYPOQ87wDsG2NT8pJVQCIiOLA%2FsbaOcH6UqMT5o20TwnAlrfo6cmDgF%2F9HMBrZ3Cv82"}]} Server: cloudflare Vary: Accept-Encoding cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Content-Encoding: gzip CF-RAY: a07fdc39d9c7d039-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B.......40:Td0c," % util alloc free span= prev= list=, i = code= addr= m->p= p->m=sched curg= ctxt: min= max= bad ts(...\"\n Heuristic match: \"telegram.me\"\n Heuristic match: \"get /d77xtr http/1.1cache-control: no-cacheconnection: keep-alivepragma: no-cacheaccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8accept-encoding: gzip, deflateaccept-language: en-us,en;q=0.9user-agent: mozilla/5.0 (windows nt 10.0; w\"\n Heuristic match: \"pas.firesupport.com\"\n Pattern match: \"https://telegram.me/d77xtr\"\n Pattern match: \"https://a.nel.cloudflare.com/report/v4?s=hnirfg\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /d77xtr HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html\napplication/xhtml+xml\napplication/xml;q=0.9\n*/*;q=0.8\nAccept-Encoding: gzip\n deflate\nAccept-Language: en-US\nen;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0\nHost: telegram.me\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"pas.firesupport.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://telegram.me/d77xtr\n Found HTTPS POST request to https://pas.firesupport.com/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"pas.firesupport.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.99\" on port \"443\"\n HTTPS traffic to \"172.67.128.38\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKey (in long string)\" in file \"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin\"\n Found registry query API: \"RegEnumValue (in long string)\" in file \"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin\"\n Found registry query API: \"RegQueryValue (in long string)\" in file \"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"GetUserName\"; File: \"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin\")\n file/memory contains long string with (Indicator: \"LookupAccountSid\"; File: \"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin\")\n file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; File: \"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin\")\n file/memory contains long string with (Indicator: \"NetGetJoinInformation\"; File: \"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\" \"------c4c2184fdc680f2c8bb4Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-1EE9E36------c4c2184fdc680f2c8bb4Content-Disposition: form-data; name=\"build_id\"4ac2e1273ffc025e8f19d4c61a21acfa------c4c2184fdc680f2c8bb4Content-Disposition: form-data; name=\"format\"json------c4c2184fdc680f2c8bb4--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":51,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6a256c259eff8603c902c4ca","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":82,"malware_family":"Loader.sh","contacted_countries":["GBR"],"submit_name":"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin","analysis_start_time":"2026-06-07T13:03:34+00:00","indicators_count":{"informative":145,"suspicious":24,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"address":"172.67.128.38","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]}],"dns_resolutions":[{"domain":"pas.firesupport.com","address":"172.67.128.38","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"domain":"telegram.me","address":"149.154.167.99","ttl":190,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]}],"http_requests":[{"host":"telegram.me","host_ip":"149.154.167.99:443","url":"/d77xtr","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /d77xtr HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0\nHost: telegram.me","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"host":"pas.firesupport.com","host_ip":"172.67.128.38:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----c4c2184fdc680f2c8bb4\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0\nContent-Length: 345\nHost: pas.firesupport.com","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}],"processes":[{"pid":404,"ppid":0,"name":"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin.exe","command_line":"","sha256":"c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5","normalized_path":"C:\\c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5.bin.exe","uid":"00000000-00000404","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["fltLib.dll","powrprof.dll","schannel.dll","rsaenh.dll","winmmbase.dll","mswsock.dll","sspicli.dll","FWPUCLNT.DLL","kernel32.dll","rpcrt4.dll","user32.dll","ws2_32.dll","gdi32.dll","advapi32.dll","sechost.dll","cryptsp.dll","OnDemandConnRouteHelper.dll","webio.dll","IPHLPAPI.DLL","msvcp_win.dll","combase.dll","oleaut32.dll","winmm.dll","nsi.dll","dnsapi.dll","rasadhlp.dll","crypt32.dll","ucrtbase.dll","ole32.dll","bcryptprimitives.dll","shlwapi.dll","winhttp.dll","mskeyprotect.dll","ncrypt.dll","gpapi.dll","win32u.dll","ntdll.dll","KernelBase.dll","cfgmgr32.dll","bcrypt.dll","msasn1.dll","ntasn1.dll","ncryptsslp.dll","gdi32full.dll","msvcrt.dll","imm32.dll","winnsi.dll","cryptbase.dll","dpapi.dll","apphelp.dll","VxSSL64.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]},{"name":"Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a256c259eff8603c902c4ca"}]}]}},"report_ids":{"sandbox_job_ids":["6a256c259eff8603c902c4ca"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample c23ababf9ec4… — Score 82/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c23ababf9ec4…. Malware family: Win/malicious_confidence_90%. Threat score 82/100. 4/27 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample c23ababf9ec4… — Score 82/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c23ababf9ec4…. Malware family: Win/malicious_confidence_90%. Threat score 82/100. 4/27 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c23ababf9ec453b2b9148b2e8ab40e1c29e56ed05ef9f6f78d3ea3b686cf17b5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample c23ababf9ec4… — Score 82/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c23ababf9ec4…. Malware family: Win/malicious_confidence_90%. Threat score 82/100. 4/27 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L43","11",{}]]