26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 43:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c2a388115e47… — Score 92/100 — Hybrid Analysis","description":"Malicious verdict for sample c2a388115e47…. Malware family: Trojan.Generic. Threat score 92/100. 10/27 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f"],"about":{"@type":"SoftwareApplication","name":"c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f","additionalType":"Malicious sample"},"threatScore":92,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4f6,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin")28:T40b,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin")29:T61d,"status= pluginpath= : unknown pc called from runtime: pid=crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress" (Indicator: "CertOpenStore"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found api reference "[VirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found api reference "[VirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found api reference "bad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.Float14901161193847656257450580596923828125strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketW %-16s %-10s %-14s %-16s %-10d %-14sinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs don" (Indicator: "CertOpenSystemStoreW"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketW %-16s %-10s %-14s %-16s %-10d %-14sinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs don" (Indicator: "CryptAcquireContextW"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found api reference "invoked exitRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultISHODNYY TEKST KONFIGA:device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableW23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshr" (Indicator: "CertGetCertificateChain"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found api reference "inkstack at bad timereflect.methodValueCallreflect.Value.Interfacereflect.Value.NumMethod" missing CPU supportexit hook invoked panicGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockpattern bits too long: bityaya stroka bez znakaconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryW116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSrunti" (Indicator: "CertFreeCertificateChain"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandle1455191522836685180664062572759576141834259033203125all goroutines stack traceGC background sweeper" (Indicator: "CertFreeCertificateContext"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin"), Found api reference "waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryunknown ABI parameter kindRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStore363797880709171295166015625PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext18189894035458564758300781259094947017729282379150390625G" (Indicator: "CertCreateCertificateContext"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin"), Found api reference ": # konfiguraciya kontrollera ASUcannot assign requested address.lib section in a.out corruptedfmt: unknown base; can't happen11368683772161602973937988281255684341886080801486968994140625slice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of rang" (Indicator: "CertAddCertificateContextToStore"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin"), Found api reference ": # konfiguraciya kontrollera ASUcannot assign requested address.lib section in a.out corruptedfmt: unknown base; can't happen11368683772161602973937988281255684341886080801486968994140625slice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of rang" (Indicator: "CertVerifyCertificateChainPolicy"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketW %-16s %-10s %-14s %-16s %-10d %-14sinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs do" (Indicator: "CertOpenSystemStoreW"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketW %-16s %-10s %-14s %-16s %-10d %-14sinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs do" (Indicator: "CryptAcquireContextW"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin"), Found api reference "invoked exitRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultISHODNYY TEKST KONFIGA:device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableW23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forksh" (Indicator: "CertGetCertificateChain"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found api reference "inkstack at bad timereflect.methodValueCallreflect.Value.Interfacereflect.Value.NumMethod" missing CPU supportexit hook invoked panicGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockpattern bits too long: bityaya stroka bez znakaconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryW116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSrunt" (Indicator: "CertFreeCertificateChain"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandle1455191522836685180664062572759576141834259033203125all goroutines stack traceGC background sweepe" (Indicator: "CertFreeCertificateContext"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext18189894035458564758300781259094947017729282379150390625" (Indicator: "CertCreateCertificateContext"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin"), Found api reference ": # konfiguraciya kontrollera ASUcannot assign requested address.lib section in a.out corruptedfmt: unknown base; can't happen11368683772161602973937988281255684341886080801486968994140625slice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of ran" (Indicator: "CertAddCertificateContextToStore"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin"), Found api reference ": # konfiguraciya kontrollera ASUcannot assign requested address.lib section in a.out corruptedfmt: unknown base; can't happen11368683772161602973937988281255684341886080801486968994140625slice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of ran" (Indicator: "CertVerifyCertificateChainPolicy"; File: "c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin")2c:T1035,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----229c99b9a544e9eb2c4aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: 5.75.217.106" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----229c99b9a544e9eb2c4aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: 5.75.217.106" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----229c99b9a544e9eb2c4aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: 5.75.217.106" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----229c99b9a544e9eb2c4aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: 5.75.217.106" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----229c99b9a544e9eb2c4aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: 5.75.217.106" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----229c99b9a544e9eb2c4aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: 5.75.217.106" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----229c99b9a544e9eb2c4aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: 5.75.217.106" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----229c99b9a544e9eb2c4aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: 5.75.217.106" Contains base64 string in header "9Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----229c99b9a544e9eb2c4aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9Content-Length: 345Host: 5.75.217.106"2d:T2fe3,Found XOR loop in file "sample.bin" at offset 92882; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1194832; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1205535; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1218335; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1228778; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1266843; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1269915; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1310908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1312879; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1355419; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1362878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1373884; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1388476; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1428123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1441435; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1455254; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1458843; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1469595; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1470875; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1481916; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1492635; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1515931; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1526599; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1526683; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1534107; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1544007; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1559195; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1559963; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1588039; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1611675; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1636679; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1649340; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1671868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1682331; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1687111; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1700796; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1713307; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1727676; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1747611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1750171; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1754011; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1756571; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1761212; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1763516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1767868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1777340; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1790652; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1795772; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1813436; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1834823; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1865148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1870012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1882523; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1903735; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1909147; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1928775; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1940123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1942171; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1997467; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2044015; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2057371; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2065787; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2077628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2085820; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2105755; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2120892; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2144700; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2153660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2156220; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161563; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2220955; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2245703; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2565683; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2760616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2874780; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2874828; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2875812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2875968; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2876028; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2876280; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2876712; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2877444; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2878140; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2878968; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2879076; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2879448; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2881164; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2881704; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2882160; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2882208; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2882436; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2882892; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2883120; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2883132; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2883384; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2883996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2884080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2884104; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2884416; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2884920; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2884968; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2885292; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2885304; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2886828; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2887008; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2888544; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2889060; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2889444; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2889576; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2889588; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2889612; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2889984; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2890020; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2890164; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2890224; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2890272; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2890668; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2890716; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2890728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2890788; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2890908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2891748; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2892420; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2892492; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2892792; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2892804; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2892828; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2892840; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2892852; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 726505; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1336809; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2619285; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 289; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 525; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 189494; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 227305; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 227665; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 228065; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 230227; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 252657; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 272784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 414469; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 415165; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 415806; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 426185; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 926296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1210488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1211151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1214991; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1218063; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1325071; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1568542; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1607183; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1818910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1852262; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1917286; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1925923; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1946470; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1966110; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2038543; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2108963; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2116588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2406506; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2730352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2878420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2949410; code bytes = 80302e:T9f2," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin\" has section name .rdata with entropy \"7.204061841185279\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\" \"------229c99b9a544e9eb2c4aContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-04775A5------229c99b9a544e9eb2c4aContent-Disposition: form-data; name=\"build_id\"30e82a36fe6be8301f209eb26300f90d------229c99b9a544e9eb2c4aContent-Disposition: form-data; name=\"format\"json------229c99b9a544e9eb2c4a--\" HTTP/1.1 200 OK\nContent-Encoding: gzip\nContent-Type: text/html; charset=UTF-8\nDate: Sat\n 04 Jul 2026 04:18:40 GMT\nServer: nginx\nVary: Accept-Encoding\nTransfer-Encoding: chunked with response body ==>626C6F636B.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$40","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 5.75.217.106 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$41","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"GetUserNameA@ADVAPI32.DLL\" in \" \"------229c99b9a544e9eb2c4aContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-04775A5------229c99b9a544e9eb2c4aContent-Disposition: form-data; name=\"build_id\"30e82a36fe6be8301f209eb26300f90d------229c99b9a544e9eb2c4aContent-Disposition: form-data; name=\"format\"json------229c99b9a544e9eb2c4a--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":33,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":33,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6a4889845a06df91b709cf99","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":92,"malware_family":"Trojan.Generic","contacted_countries":["DEU"],"submit_name":"c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin","analysis_start_time":"2026-07-04T04:18:13+00:00","indicators_count":{"informative":140,"suspicious":26,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"5.75.217.106","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]}],"dns_resolutions":null,"http_requests":[{"host":"5.75.217.106","host_ip":"5.75.217.106:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----229c99b9a544e9eb2c4a\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.9) Gecko/20100101 Firefox/156.9\nContent-Length: 345\nHost: 5.75.217.106","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}],"processes":[{"pid":7996,"ppid":0,"name":"c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin.exe","command_line":"","sha256":"c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f","normalized_path":"C:\\c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f.bin.exe","uid":"00000000-00007996","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["cryptbase.dll","dpapi.dll","cfgmgr32.dll","gdi32.dll","ntdll.dll","kernel32.dll","rpcrt4.dll","fltLib.dll","user32.dll","shlwapi.dll","win32u.dll","msvcp_win.dll","advapi32.dll","winmmbase.dll","bcrypt.dll","IPHLPAPI.DLL","crypt32.dll","msasn1.dll","webio.dll","winnsi.dll","ncrypt.dll","rsaenh.dll","ws2_32.dll","sechost.dll","combase.dll","mskeyprotect.dll","ncryptsslp.dll","gpapi.dll","apphelp.dll","ucrtbase.dll","bcryptprimitives.dll","winhttp.dll","mswsock.dll","VxSSL64.dll","msvcrt.dll","imm32.dll","schannel.dll","gdi32full.dll","KernelBase.dll","ole32.dll","oleaut32.dll","cryptsp.dll","winmm.dll","powrprof.dll","nsi.dll","OnDemandConnRouteHelper.dll","sspicli.dll","ntasn1.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]},{"name":"Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a4889845a06df91b709cf99"}]}]}},"report_ids":{"sandbox_job_ids":["6a4889845a06df91b709cf99"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample c2a388115e47… — Score 92/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c2a388115e47…. Malware family: Trojan.Generic. Threat score 92/100. 10/27 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample c2a388115e47… — Score 92/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c2a388115e47…. Malware family: Trojan.Generic. Threat score 92/100. 10/27 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample c2a388115e47… — Score 92/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c2a388115e47…. Malware family: Trojan.Generic. Threat score 92/100. 10/27 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L43","11",{}]]