21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 4f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4df,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/GenKryptik_AGeneric.CKZ trojan Sample cf8d39871478… — Score 87/100 — Hybrid Analysis","description":"Malicious verdict for sample cf8d39871478…. Malware family: Win64/GenKryptik_AGeneric.CKZ trojan. Threat score 87/100. 4/27 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac","keywords":["Malicious","Win64/GenKryptik_AGeneric.CKZ trojan","malware analysis","sandbox report","threat intelligence","cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac","additionalType":"Malicious sample"},"threatScore":87,"malwareFamily":"Win64/GenKryptik_AGeneric.CKZ trojan","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T9b4,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.00180000.00000004.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp")23:T87b,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp")24:Ta92,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp")25:T86d,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp, 00000000-00007184.00000001.235323.9817F000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp, 00000000-00007184.00000001.235323.9817F000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007184.00000001.235323.9817F000.00000002.mdmp")26:T568,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007184.00000000.235089.00200000.00000004.mdmp, 00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007184.00000000.235089.00200000.00000004.mdmp, 00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007184.00000000.235089.00200000.00000004.mdmp, 00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007184.00000000.235089.00200000.00000004.mdmp, 00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp")27:T6c2,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressweb-deploymentfile too largeis a directorylevel 2 haltedlevel 3 ha" (Indicator: "CertOpenStore"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "ltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "ltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChange" (Indicator: "CertOpenSystemStoreW"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChange" (Indicator: "CryptAcquireContextW"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "> s.nelemsbad sweepgen in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll f" (Indicator: "CertGetCertificateChain"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "ailedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup se" (Indicator: "CertFreeCertificateChain"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in finalizernegative idle mark workersuse of invalid sw" (Indicator: "CertFreeCertificateContext"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "eepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorychannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gs" (Indicator: "CertCreateCertificateContext"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "ntries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of" (Indicator: "CertAddCertificateContextToStore"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin"), Found api reference "ntries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of" (Indicator: "CertVerifyCertificateChainPolicy"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressweb-deploymentfile too largeis a directorylevel 2 haltedlevel 3 h" (Indicator: "CertOpenStore"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChang" (Indicator: "CertOpenSystemStoreW"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChang" (Indicator: "CryptAcquireContextW"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "> s.nelemsbad sweepgen in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll" (Indicator: "CertGetCertificateChain"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "ailedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup s" (Indicator: "CertFreeCertificateChain"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in finalizernegative idle mark workersuse of invalid s" (Indicator: "CertFreeCertificateContext"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on g" (Indicator: "CertCreateCertificateContext"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000000.235089.B1FF9000.00000004.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000000.235089.B1FF9000.00000004.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found api reference "runtime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressweb-deploymentfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressweb-deploymentfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp")2a:T461,Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000000.235089.B1FF9000.00000004.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp")2b:Tbf6,Contains base64 string in header "/dzokdfz" in header "GET /dzokdfz HTTP/1.1Host: t.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "keep" in header "GET /dzokdfz HTTP/1.1Host: t.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "funCache" in header "GET / HTTP/1.1Host: dwarf.yellowsatchel.funCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "keep" in header "GET / HTTP/1.1Host: dwarf.yellowsatchel.funCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: dwarf.yellowsatchel.funPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----TpkFK3W1jgwHY6ONsqotCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: dwarf.yellowsatchel.funPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----TpkFK3W1jgwHY6ONsqotCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Host: dwarf.yellowsatchel.funPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----TpkFK3W1jgwHY6ONsqotCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: dwarf.yellowsatchel.funPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----TpkFK3W1jgwHY6ONsqotCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "data" in header "POST / HTTP/1.1Host: dwarf.yellowsatchel.funPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----TpkFK3W1jgwHY6ONsqotCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Host: dwarf.yellowsatchel.funPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----TpkFK3W1jgwHY6ONsqotCache-Control: no-cacheContent-Length: 254"2c:T43b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match - ChaCha20 encryption algorithm2d:T10fc,Found XOR loop in file "sample.bin" at offset 85266; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1538559; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1946155; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1963931; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1965995; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2267343; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2481516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2481564; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2482500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2482704; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2482956; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2483388; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2484120; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2484816; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2485572; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2485680; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2486052; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2487756; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2488296; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2488752; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2488800; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2489460; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2489700; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2489712; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2489964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2490576; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2490660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2490684; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2490996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2491500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2491548; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2491872; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2491884; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2493036; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2493192; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2494920; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2495112; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2495232; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1901703; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1987380; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 175638; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211913; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212273; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212673; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 214835; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 237169; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 257296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 398597; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 399293; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 399934; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 582221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 582687; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 819816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 863464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1916808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2324320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2439120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2494480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2544356; code bytes = 80302e:Tc6f," HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sat 11 Apr 2026 10:08:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12379 Connection: keep-alive Set-Cookie: stel_ssid=6813203bb6c9628c7e_16477118267071036685; expires=Sun 12 Apr 2026 10:08:36 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: dwarf.yellowsatchel.fun Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Response ==> HTTP/1.1 200 OK Date: Sat 11 Apr 2026 10:08:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qOgpgdp6s%2FDTACfdW6QP2VAUmUDX95g06y4LzNbcj6Ima7hAQLe%2FYJFjz3ISLZ1PLejPN0IFCtdbl35qGMHMR2bWxOORdBIIgFOu5FeeyNwP37oouhuJs2YzaOns4vNEFQyog8bjV4vcAQ%3D%3D"}]} Server: cloudflare Vary: Accept-Encoding cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=13 cfOrigin;dur=483 CF-RAY: 9ea930e80985cf1f-SJC alt-svc: h2=":443"; ma=60 with response body ==>6F6B.......37:Tca8,"4.cv" Heuristic match: "pvd.xn" Heuristic match: "#r.ky" Heuristic match: "pvd.fj" Heuristic match: "internal/abi.name.name" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.srcfunc.name" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Heuristic match: "# r.ky" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "https://t.me/dzokdfz" Pattern match: "https://telegram.me/oxffffw" Pattern match: "https://steamcommunity.com/profiles/76561198714927440" Pattern match: "t.me/dzokdfz" Pattern match: "http://dwarf.yellowsatchel.fun/" Heuristic match: "ntrust.net" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=0zkbofq%2f5fcniolcvr%2bbtcqzh6invxq9lfytzz3p6ouiedv%2fjnlymibmptxi%2fyiqhwxs6glf4lpkiwz9s6fhkjxikaph%2bkzhwi2gmf8lu3pc9xlgxkjlftb8302b2duzsmw%2f9z6rqiyidq%3d%3d" Heuristic match: "*.t.me" Pattern match: "https://web.telegram.org" Pattern match: "http://dwarf.yellowsatchel.fun|" Pattern match: "telegram.org/img/website_icon.svg?4" Pattern match: "telegram.org/img/apple-touch-icon.png" Pattern match: "telegram.org/img/favicon-32x32.png" Pattern match: "telegram.org/img/favicon-16x16.png" Pattern match: "telegram.org/img/favicon.ico" Pattern match: "telegram.org/css/font-roboto.css?1" Pattern match: "telegram.org/css/bootstrap.min.css?3" Pattern match: "telegram.org/css/telegram.css?249" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "telegram.org/dl?tme=6813203bb6c9628c7e_16477118267071036685" Pattern match: "telegram.org/js/tgwallpaper.min.js?3" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=qogpgdp6s%2fdtacfdw6qp2vaumudx95g06y4lznbcj6ima7haqle%2fyjfjz3islz1plejpn0ifctdbl35qgmhmr2bwxoordbiigfou5feeynwp37oouhujs2" Pattern match: "http://dwarf.yellowsatchel.fu" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "7rt.com/c36h" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1$0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0"40:Tc34,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007184.00000000.235089.93850000.00000004.mdmp") Found URL "http://https://https://33acb2386f65ed4f39245f629d68fa40." - Source: "00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found URL "https://t.me/dzokdfzkdoziamozilla/5.0" - Source: "00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found URL "https://telegram.me/oxffffwa10fswmozilla/5.0" - Source: "00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561198714927440a10fswmozilla/5.0" - Source: "00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found URL "http://dwarf.yellowsatchel.fun/:\windows\system32\urlmon.dllecurity=impersonation" - Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp") Found URL "https://t.me/dzokdfzpl3>pl3>https://t.me/dzokdfzpl3>pl3>pl3>pl3>pl3>pl3>pl3>pl3>4839ion,000000000000000000000000000000000000000p000000000000000000000000000000000000" - Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=0zkbofq%2f5fcniolcvr%2bbtcqzh6invxq9lfytzz3p6ouiedv%2fjnlymibmptxi%2fyiqhwxs6glf4lpkiwz9s6fhkjxikaph%2bkzhwi2gmf8lu3pc9xlgxkjlftb8302b2duzsmw%2f9z6rqiyidq%3d%3d" - Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp") Found URL "https://web.telegram.org');" - Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp") Found URL "http://dwarf.yellowsatchel.fun" - Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp") Found URL "https://t.me/dzokdfz" - Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp") Found URL "http://dwarf.yellowsatchel.fun/" - Source: "00000000-00007184.00000001.235323.DC470000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007184.00000001.235323.DC470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007184.00000001.235323.DC470000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007184.00000001.235323.DC470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007184.00000001.235323.DC470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007184.00000001.235323.DC470000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007184.00000001.235323.DC470000.00000004.mdmp")41:T71f,Found registry query API: "RegOpenKey (in long string)" in file "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin" Found registry query API: "RegQueryValue (in long string)" in file "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin" Found registry query API: "RegOpenKeyExA" in "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp" Found registry query API: "RegGetValueW" in "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp" Found registry query API: "RegOpenKey (in long string)" in "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp" Found registry query API: "RegQueryValue (in long string)" in "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp"42:T8a6,file/memory contains long string with (Indicator: "GetUserName"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp")43:Te5f,Found string "chacha8" (Indicator: "chacha"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "aes"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "aeshashbody" (Indicator: "aes"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "internal/chacha8rand/chacha8_amd64.s" (Indicator: "chacha"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "runtime.useAeshash" (Indicator: "aes"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "runtime.aeskeysched" (Indicator: "aes"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found string "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp, 00000000-00007184.00000001.235323.DC470000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp") Found string "chacha8" (Indicator: "chacha"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") Found string "*chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") Found string "internal/chacha8rand" (Indicator: "chacha"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") Found string "???pc= GadxaesshaavxfmaNONEdiskzoneeasttypewestprodpod-lossbindboolint8uintchanfuncallgallprootitabsbrkidledeadsync is LEAFheapbase at Has of ) = <==GOGC] = pc=true+Inf-Inf: p=cas1cas2cas3cas4cas5cas6" (Indicator: "aes"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp")44:T53c,file/memory contains long string with (Indicator: "FindNextFile"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "FindFirstFile"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "FindNextFile"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") file/memory contains long string with (Indicator: "FindFirstFile"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp")45:Tf2e,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "Process32First"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp")46:T682,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "GetProcAddress"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "GetProcAddress"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp, 00000000-00007184.00000001.235323.9817F000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp, 00000000-00007184.00000001.235323.9817F000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007184.00000001.235323.9817F000.00000002.mdmp")47:T7b7,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp")48:T490,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "ExitProcess"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") file/memory contains long string with (Indicator: "TerminateProcess"; File: "cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007184.00000000.235089.40000000.00000040.mdmp, 00000000-00007184.00000001.235323.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "TerminateProcess"; Source: "00000000-00007184.00000001.235323.97F8D000.00000002.mdmp")49:T691," "------TpkFK3W1jgwHY6ONsqotContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------TpkFK3W1jgwHY6ONsqotContent-Disposition: form-data; name="build_id"33acb2386f65ed4f39245f629d68fa40------TpkFK3W1jgwHY6ONsqot--" HTTP/1.1 200 OK Date: Sat 11 Apr 2026 10:08:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=0ZKBofQ%2F5fCniOlCVR%2BBTCQzh6inVxQ9lfYTzz3p6OUiEdV%2FJNlymibmPtXi%2FYiqhwXS6glF4lpKiwZ9s6fhKjxIKApH%2BkZHWI2Gmf8lU3pC9xlgxkJLFTB8302b2DuzsMW%2F9Z6rqiYIDQ%3D%3D"}]} Server: cloudflare Vary: Accept-Encoding cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=21 cfOrigin;dur=385 CF-RAY: 9ea930ed3c35cf1e-SJC alt-svc: h2=":443"; ma=60 with response body ==>626C6F636B.......4c:T47d,Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies\DNTException\" (Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp") Found string "INetCookies" (Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp") Found string "??\c:\users\hapubws\appdata\local\microsoft\windows\inetcookies" (Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00007184.00000001.235323.93850000.00000004.mdmp, 00000000-00007184.00000001.235323.DC470000.00000004.mdmp") Found string ":\users\hapubws\appdata\local\microsoft\windows\inetcookies" (Source: "00000000-00007184.00000001.235323.DC470000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies\" (Source: "00000000-00007184.00000001.235323.DC470000.00000004.mdmp") Found string "\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00007184.00000001.235323.DC470000.00000004.mdmp") Found string "icrosoft\Windows\INetCookies" (Source: "00000000-00007184.00000001.235323.DC470000.00000004.mdmp")4d:T635,"" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") ".skype.com1&0" (Indicator: "skype.com") "community-stage.skype.com1" (Indicator: "skype.com")4e:Tbac,"try{if(window.parent!=null&&window!=window.parent){window.parent.postMessage(JSON.stringify({eventType:'web_app_open_tg_link',eventData:{path_full:\"\\/dzokdfz\"}}),'https://web.telegram.org');}}catch(e){}\" (Indicator: \"postmessage\"; Source: \"00000000-00007184.00000001.235323.93850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\" \"------TpkFK3W1jgwHY6ONsqotContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058------TpkFK3W1jgwHY6ONsqotContent-Disposition: form-data; name=\"build_id\"33acb2386f65ed4f39245f629d68fa40------TpkFK3W1jgwHY6ONsqot--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":63,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["new_domain"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"69da1d748256285a9708c9d2","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":87,"malware_family":"Evo","contacted_countries":["GBR"],"submit_name":"cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin","analysis_start_time":"2026-04-11T10:07:49+00:00","indicators_count":{"informative":189,"suspicious":33,"malicious":4},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"address":"104.21.36.52","port":80,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]}],"dns_resolutions":[{"domain":"dwarf.yellowsatchel.fun","address":"104.21.36.52","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"domain":"t.me","address":"149.154.167.99","ttl":196,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]}],"http_requests":[{"host":"t.me","host_ip":"149.154.167.99:443","url":"/dzokdfz","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dzokdfz HTTP/1.1\nHost: t.me\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"host":"dwarf.yellowsatchel.fun","host_ip":"104.21.36.52:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: dwarf.yellowsatchel.fun\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}],"processes":[{"pid":7184,"ppid":0,"name":"cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin.exe","command_line":"","sha256":"cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac","normalized_path":"C:\\cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac.bin.exe","uid":"00000000-00007184","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["rasadhlp.dll","gdi32full.dll","GdiPlus.dll","winhttp.dll","dpapi.dll","wintrust.dll","gpapi.dll","kernel32.dll","cryptsp.dll","windows.storage.dll","profapi.dll","msIso.dll","bcryptprimitives.dll","apphelp.dll","ucrtbase.dll","cfgmgr32.dll","KernelBase.dll","VxSSL64.dll","rpcrt4.dll","powrprof.dll","shell32.dll","urlmon.dll","cryptbase.dll","ncryptsslp.dll","msasn1.dll","OnDemandConnRouteHelper.dll","mswsock.dll","winnsi.dll","ncrypt.dll","imagehlp.dll","FWPUCLNT.DLL","cryptnet.dll","win32u.dll","imm32.dll","wininet.dll","rsaenh.dll","fltLib.dll","msvcp_win.dll","combase.dll","iertutil.dll","ntasn1.dll","oleaut32.dll","winmm.dll","schannel.dll","mskeyprotect.dll","sechost.dll","shlwapi.dll","kernel.appcore.dll","user32.dll","ole32.dll","SHCore.dll","bcrypt.dll","sspicli.dll","dnsapi.dll","advapi32.dll","nsi.dll","ntdll.dll","ws2_32.dll","gdi32.dll","msvcrt.dll","winmmbase.dll","crypt32.dll","IPHLPAPI.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7184:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7184:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"name":"Local\\SM0:7184:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"name":"SM0:7184:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"name":"SM0:7184:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7184:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69da1d748256285a9708c9d2"}]}]}},"report_ids":{"sandbox_job_ids":["69da1d748256285a9708c9d2"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Win64/GenKryptik_AGeneric.CKZ trojan Sample cf8d39871478… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cf8d39871478…. Malware family: Win64/GenKryptik_AGeneric.CKZ trojan. Threat score 87/100. 4/27 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac"}],["$","meta","4",{"property":"og:title","content":"Malicious Win64/GenKryptik_AGeneric.CKZ trojan Sample cf8d39871478… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cf8d39871478…. Malware family: Win64/GenKryptik_AGeneric.CKZ trojan. Threat score 87/100. 4/27 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cf8d3987147837bbd4f60c5f0182b19971cd187955c421933bc117eeb4d921ac"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win64/GenKryptik_AGeneric.CKZ trojan Sample cf8d39871478… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cf8d39871478…. Malware family: Win64/GenKryptik_AGeneric.CKZ trojan. Threat score 87/100. 4/27 AV engines flagged this file. 4 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4f","11",{}]]