26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 67:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample ec89ee06be23… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample ec89ee06be23…. Malware family: Win/malicious_confidence_70%. Threat score 86/100. 2/27 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f"],"about":{"@type":"SoftwareApplication","name":"BoolstrappperFIXM.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6f1,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "command_protocolVirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005964.00000001.182398.7FA90000.00000004.mdmp, 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp, 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp")28:T1341,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") file/memory contains long string with (Indicator: "QueryPerformanceFrequency"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "syscall.procGetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "runtime._GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "runtime._QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "runtime._QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "runtime._NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "runtime._NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp") Found reference to API "syscall.procGetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "runtime._GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "runtime._QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "runtime._QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "runtime._NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "runtime._NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005964.00000001.182398.7FA90000.00000004.mdmp, 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp, 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp")29:T111d,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "runtime.getLoadLibraryEx" (Indicator: "LoadLibrary"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "runtime.getLoadLibrary" (Indicator: "LoadLibrary"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "syscall.procFreeLibrary" (Indicator: "FreeLibrary"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "runtime._LoadLibraryExA" (Indicator: "LoadLibrary"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "runtime._LoadLibraryExW" (Indicator: "LoadLibrary"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "runtime.useLoadLibraryEx" (Indicator: "LoadLibrary"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "syscall.procFreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "runtime._LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "runtime._LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "runtime.useLoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005964.00000002.184318.004A0000.00000004.mdmp")2a:T6c3,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp, 00000000-00005964.00000001.182398.7FB49000.00000004.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp, 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp, 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp, 00000000-00005964.00000001.182398.7FB49000.00000004.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp, 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp, 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp")2b:T784,"m=worker mode != sweepgen MB) workers= called from flushedWork heap_marked= idlethreads= is nil, not nStackRoots= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=-byte block (CertOpenStoreCommunicationFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiOld_HungarianPrimaryEngineRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWStarlightBetaVirtualUnlockWriteConsoleWbad flushGen bad map statedalTLDpSugct?debugCall20" (Indicator: "CertOpenStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "48exchange fullfatal error: gethostbynamegetservbynamelevel 3 resetload64 failedmin too largenil stackbaseout of memoryoxygen_cutoffruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabtriggerRatio=value method xadd64 failedxchg64 failed}sched={pc: but progSize nmidlelocked= on zero Value out of range procedure in untyped args -thread limitCertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWHeatProtectionLAUNCH_SUCCESSMB; allocated NetUserGetInfoORBIT_ACHIEVEDOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad span statebad stack sizefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmanualOverrideno module datano such devicepollCache.lockprotocol errorruntime: full=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytoo ma" (Indicator: "CertCloseStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "48exchange fullfatal error: gethostbynamegetservbynamelevel 3 resetload64 failedmin too largenil stackbaseout of memoryoxygen_cutoffruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabtriggerRatio=value method xadd64 failedxchg64 failed}sched={pc: but progSize nmidlelocked= on zero Value out of range procedure in untyped args -thread limitCertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWHeatProtectionLAUNCH_SUCCESSMB; allocated NetUserGetInfoORBIT_ACHIEVEDOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad span statebad stack sizefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmanualOverrideno module datano such devicepollCache.lockprotocol errorruntime: full=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytoo ma" (Indicator: "CryptGenRandom"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "ection refusedfaketimeState.lockfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errormultihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintreflect: Zero(nil)runtime.semacreateruntime.semawakeupruntime: npages = runtime: range = {streams pipe errorsystem page size (tracebackancestorsvalue out of range called using nil *, g->atomicstatus=, gp->atomicstatus=Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC work not flushedGetCurrentProcessIdGetSystemDirectoryWGetTokenInformationHaiti Standard TimeIDS_Binary_OperatorIndia Standard TimeKhitan_Small_ScriptKorea Standard TimeLibya Standard TimeNepal Standard TimePattern_White_SpaceRussia Time Zone 10Russia Time Zone 11Samoa Standard TimeSudan Standard TimeSyria Standard TimeTokyo Standard TimeTomsk Standard TimeTonga Standard TimeWaitForSingleObjectadjustt" (Indicator: "CryptReleaseContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated spanArabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetCurrentDirectoryWGetFileAttributesExWIDS_Trinary_OperatorIsrael Standard TimeJordan Standard TimeMeroitic_HieroglyphsNtUnmapViewOfSe" (Indicator: "CertOpenSystemStoreW"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated spanArabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetCurrentDirectoryWGetFileAttributesExWIDS_Trinary_OperatorIsrael Standard TimeJordan Standard TimeMeroitic_HieroglyphsNtUnmapViewOfSe" (Indicator: "CryptAcquireContextW"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "valid p state) must be a power of 2Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeLogical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointPerformanceOptimizationQyzylorda Standard TimeSetEnvironmentVariableWSingapore Standard TimeSri Lanka Standard TimeTocantins Standard TimeVenezuela Standard TimeVolgograd Standard TimeW. Europe Standard TimeWest Asia Standard TimeWest Bank Standard Time" not found in registry", missing CPU supportchan receive (nil chan)close of closed channeldevice or resource busyfatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = left over markroot jobsmakechan: bad alignmentnanotime returning zerono space left on deviceoperation not permitte" (Indicator: "CertGetCertificateChain"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "doperation not supportedpanic during preemptoffprocresize: invalid argreflect.Value.Interfacereflect.Value.NumMethodreflect.methodValueCallruntime: internal errorruntime: invalid type runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding locksshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (work.nwait > work.nprocAzerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeSA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeUS Eastern Standard Time" required CPU featurebad defer entry in panicbad defer size class: i=bypassed recovery failedcan't scan our own stackconnection reset by peerdouble traceGCSweepStartfunction not implementedgcDrainN phase incorrecthash of unhashable type initSpan: unaligned baselevel 2 n" (Indicator: "CertFreeCertificateChain"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "lock: lock countslice bounds out of rangesocket type not supportedstartm: p has runnable gsstoplockedm: not runnableunexpected fault address unexpected key value type using unaddressable valueBougainville Standard TimeCentral Asia Standard TimeCertFreeCertificateContextE. Australia Standard TimeEkaterinburg Standard TimeGODEBUG: can not disable "GetFileInformationByHandleLine Islands Standard TimeNewfoundland Standard TimePostQueuedCompletionStatusSaint Pierre Standard TimeSignal verification failedSouth Africa Standard TimeW. Australia Standard TimeWest Pacific Standard Timebinary.Read: invalid type call from unknown functioncorrupted semaphore ticketentersyscall inconsistent forEachP: P did not run fnfreedefer with d.fn != nilinitSpan: unaligned lengthinvalid request descriptorname not unique on networkno CSI structure availableno message of desired typenotewakeup - double wakeupout of memory (stackalloc)persistentalloc: size == 0required key not availableruntime: bad span s.state=shrinking stack in libcall" (Indicator: "CertFreeCertificateContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "startlockedm: locked to meCertEnumCertificatesInStoreEaster Island Standard TimeG waiting list is corruptedaddress not a stack addresschannel number out of rangecommunication error on sendcould not find QPC syscallsgcstopm: not waiting for gcgrowslice: cap out of rangeinternal lockOSThread errorinvalid profile bucket typekey was rejected by servicemakechan: size out of rangemakeslice: cap out of rangemakeslice: len out of rangemspan.sweep: bad span statenot a XENIX named type fileprogToPointerMask: overflowrunlock of unlocked rwmutexruntime: asyncPreemptStack=runtime: checkdead: find g runtime: checkdead: nmidle=runtime: netpollinit failedruntime: thread ID overflowruntime" (Indicator: "CertEnumCertificatesInStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "unlock: lock countsigsend: inconsistent statestack size not a power of 2startm: negative nmspinningstopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish name for time zone "FixedStack is not power-of-2Prepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredfatal: morestack on gsignalfile descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackprotocol driver not attachedreflect: In of non-func typeregion exceeds uintptr rangeruntime.semasleep unexpectedruntim" (Indicator: "CertCreateCertificateContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "ace: ...additional frames elided....lib section in a.out corruptedCentral Brazilian Standard TimeMountain Standard Time (Mexico)W. Central Africa Standard Timebad write barrier buffer boundscall from within the Go runtimecannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent internal error - misuse of itabmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size reflect: Len of non-array type reflect: NumIn of non-func typeresetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x] (types from different packages)CertAddCertificateContextToStoreCertVerifyCertificateChainPolicyWSAGetOverlappedResult not found" not supported for cpu option "end outside usable address spacenumerical argument out of domainpanic while printing panic valuereflect.nameFrom: tag too long: reflect: NumIn of" (Indicator: "CertAddCertificateContextToStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "ace: ...additional frames elided....lib section in a.out corruptedCentral Brazilian Standard TimeMountain Standard Time (Mexico)W. Central Africa Standard Timebad write barrier buffer boundscall from within the Go runtimecannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent internal error - misuse of itabmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size reflect: Len of non-array type reflect: NumIn of non-func typeresetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x] (types from different packages)CertAddCertificateContextToStoreCertVerifyCertificateChainPolicyWSAGetOverlappedResult not found" not supported for cpu option "end outside usable address spacenumerical argument out of domainpanic while printing panic valuereflect.nameFrom: tag too long: reflect: NumIn of" (Indicator: "CertVerifyCertificateChainPolicy"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "soleWSTATUS_CHECKSYNCHRONIZEDSecurityScanSetEndOfFileSora_SompengSyloti_NagriTransmitFileVirtualAllocVoyagerAlphaabi mismatchadvapi32.dllbad flushGenbad g statusbad g0 stackbad recoverycan't happencas64 failedchan receiveconservationdumping heapend tracegcentersyscallgcBitsArenasgcpacertracehost is downillegal seekinvalid slotiphlpapi.dllkernel32.dlllfstack.pushmadvdontneedmheapSpecialmspanSpecialnetapi32.dllraceFiniLockreleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode != sweepgen MB) workers= called from flushedWork heap_marked= idlethreads= is nil not nStackRoots= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= gp->status=-byte block (CertOpenStoreCommunicationFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiOld_HungarianPrimaryEngineRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWStarlightBetaVirtualUnlockWriteConsoleWbad flushGen bad map statedalTLDpSugct?debugCall2" (Indicator: "CertOpenStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "48exchange fullfatal error: gethostbynamegetservbynamelevel 3 resetload64 failedmin too largenil stackbaseout of memoryoxygen_cutoffruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabtriggerRatio=value method xadd64 failedxchg64 failed}sched={pc: but progSize nmidlelocked= on zero Value out of range procedure in untyped args -thread limitCertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWHeatProtectionLAUNCH_SUCCESSMB; allocated NetUserGetInfoORBIT_ACHIEVEDOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad span statebad stack sizefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmanualOverrideno module datano such devicepollCache.lockprotocol errorruntime: full=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytoo m" (Indicator: "CertCloseStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "48exchange fullfatal error: gethostbynamegetservbynamelevel 3 resetload64 failedmin too largenil stackbaseout of memoryoxygen_cutoffruntime: seq=runtime: val=srmount errortimer expiredtraceStackTabtriggerRatio=value method xadd64 failedxchg64 failed}sched={pc: but progSize nmidlelocked= on zero Value out of range procedure in untyped args -thread limitCertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWHeatProtectionLAUNCH_SUCCESSMB; allocated NetUserGetInfoORBIT_ACHIEVEDOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad span statebad stack sizefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltedmanualOverrideno module datano such devicepollCache.lockprotocol errorruntime: full=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytoo m" (Indicator: "CryptGenRandom"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "ection refusedfaketimeState.lockfile name too longforEachP: not donegarbage collectionidentifier removedindex out of rangeinput/output errormultihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintreflect: Zero(nil)runtime.semacreateruntime.semawakeupruntime: npages = runtime: range = {streams pipe errorsystem page size (tracebackancestorsvalue out of range called using nil *, g->atomicstatus=, gp->atomicstatus=Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC work not flushedGetCurrentProcessIdGetSystemDirectoryWGetTokenInformationHaiti Standard TimeIDS_Binary_OperatorIndia Standard TimeKhitan_Small_ScriptKorea Standard TimeLibya Standard TimeNepal Standard TimePattern_White_SpaceRussia Time Zone 10Russia Time Zone 11Samoa Standard TimeSudan Standard TimeSyria Standard TimeTokyo Standard TimeTomsk Standard TimeTonga Standard TimeWaitForSingleObjectadjust" (Indicator: "CryptReleaseContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated spanArabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetCurrentDirectoryWGetFileAttributesExWIDS_Trinary_OperatorIsrael Standard TimeJordan Standard TimeMeroitic_HieroglyphsNtUnmapViewOfS" (Indicator: "CertOpenSystemStoreW"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated spanArabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetCurrentDirectoryWGetFileAttributesExWIDS_Trinary_OperatorIsrael Standard TimeJordan Standard TimeMeroitic_HieroglyphsNtUnmapViewOfS" (Indicator: "CryptAcquireContextW"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "valid p state) must be a power of 2Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeLogical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointPerformanceOptimizationQyzylorda Standard TimeSetEnvironmentVariableWSingapore Standard TimeSri Lanka Standard TimeTocantins Standard TimeVenezuela Standard TimeVolgograd Standard TimeW. Europe Standard TimeWest Asia Standard TimeWest Bank Standard Time" not found in registry", missing CPU supportchan receive (nil chan)close of closed channeldevice or resource busyfatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = left over markroot jobsmakechan: bad alignmentnanotime returning zerono space left on deviceoperation not permitt" (Indicator: "CertGetCertificateChain"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "doperation not supportedpanic during preemptoffprocresize: invalid argreflect.Value.Interfacereflect.Value.NumMethodreflect.methodValueCallruntime: internal errorruntime: invalid type runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding locksshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (work.nwait > work.nprocAzerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeSA Eastern Standard TimeSA Pacific Standard TimeSA Western Standard TimeUS Eastern Standard Time" required CPU featurebad defer entry in panicbad defer size class: i=bypassed recovery failedcan't scan our own stackconnection reset by peerdouble traceGCSweepStartfunction not implementedgcDrainN phase incorrecthash of unhashable type initSpan: unaligned baselevel 2" (Indicator: "CertFreeCertificateChain"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "lock: lock countslice bounds out of rangesocket type not supportedstartm: p has runnable gsstoplockedm: not runnableunexpected fault address unexpected key value type using unaddressable valueBougainville Standard TimeCentral Asia Standard TimeCertFreeCertificateContextE. Australia Standard TimeEkaterinburg Standard TimeGODEBUG: can not disable "GetFileInformationByHandleLine Islands Standard TimeNewfoundland Standard TimePostQueuedCompletionStatusSaint Pierre Standard TimeSignal verification failedSouth Africa Standard TimeW. Australia Standard TimeWest Pacific Standard Timebinary.Read: invalid type call from unknown functioncorrupted semaphore ticketentersyscall inconsistent forEachP: P did not run fnfreedefer with d.fn != nilinitSpan: unaligned lengthinvalid request descriptorname not unique on networkno CSI structure availableno message of desired typenotewakeup - double wakeupout of memory (stackalloc)persistentalloc: size == 0required key not availableruntime: bad span s.state=shrinking stack in libcal" (Indicator: "CertFreeCertificateContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found api reference "unlock: lock countsigsend: inconsistent statestack size not a power of 2startm: negative nmspinningstopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish name for time zone "FixedStack is not power-of-2Prepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredfatal: morestack on gsignalfile descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackprotocol driver not attachedreflect: In of non-func typeregion exceeds uintptr rangeruntime.semasleep unexpectedrunti" (Indicator: "CertCreateCertificateContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "syscall.procCryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "syscall.procCryptGenRandom" (Indicator: "CryptGenRandom"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "syscall.procCryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "syscall.procCertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "syscall.procCertCloseStore" (Indicator: "CertCloseStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "syscall.procCertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin"), Found api reference "syscall.procCertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin")2d:T7b0,file/memory contains long string with (Indicator: "CertCloseStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") file/memory contains long string with (Indicator: "CryptReleaseContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") file/memory contains long string with (Indicator: "CertOpenSystemStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") file/memory contains long string with (Indicator: "CryptAcquireContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") file/memory contains long string with (Indicator: "CertFreeCertificateContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") file/memory contains long string with (Indicator: "CertEnumCertificatesInStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "syscall.procCryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "syscall.procCryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "syscall.procCertCloseStore" (Indicator: "CertCloseStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "syscall.procCertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "syscall.procCertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found reference to API "syscall.procCertOpenSystemStoreW" (Indicator: "CertOpenSystemStore"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin")2e:T303e,Contains base64 string in header "POST" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 128Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 128Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 128Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 128Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 128Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 5828Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 5828Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 5828Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 5828Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 5828Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 368Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 36720Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 73136Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "233328Connection" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 233328Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 80408Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 80408Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 80408Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 80408Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 80408Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 102260Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 102260Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 102260Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 102260Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "102260Connection" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 102260Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 102260Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 240612Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 240612Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 240612Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 240612Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "240612Connection" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 240612Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 240612Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "466376Connection" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 466376Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 160Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 160Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 160Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "application/jsonHost" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 160Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /7a4258876d1d42c1.php HTTP/1.1Content-Type: application/jsonHost: 138.226.237.76Content-Length: 160Connection: Keep-AliveCache-Control: no-cache"2f:Tb3c,Found XOR loop in file "sample.bin" at offset 429676; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1817624; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1989366; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2079610; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2163894; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2353426; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2477028; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2582440; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3558712; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3824440; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3899988; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3901000; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4160730; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 85796; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2065484; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2302108; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 149522; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 149859; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 201445; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 243306; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 336440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1619856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1683240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1730024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1735336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2369221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2373541; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2672984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2674840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2817096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3347737; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3535760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3555776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3580080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3665400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3757368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3868272; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3980288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4099260; code bytes = 803030:T5dd,file/memory contains long string with (Indicator: "GetCommandLine"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; File: "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005964-00000C2C-1765202861") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005964-00000C2C-1765270200") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp")31:Tae4,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp")32:T9e4,Found system information discovery API: "GetEnvironmentStringsW" in file "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin" Found system information discovery API: "GetSystemInfo" in file "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin" Found system information discovery API: "syscall.procGetEnvironmentStringsW" in file "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin" Found system information discovery API: "internal/syscall/windows/registry.procExpandEnvironmentStringsW" in file "ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005964.00000000.180475.00500000.00000004.mdmp, 00000000-00005964.00000000.180475.40000000.00000040.mdmp, 00000000-00005964.00000001.182398.00500000.00000004.mdmp, 00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp, 00000000-00005964.00000003.187495.40000000.00000040.mdmp" Found system information discovery API: "syscall.procGetEnvironmentStringsW" in "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp" Found system information discovery API: "internal/syscall/windows/registry.procExpandEnvironmentStringsW" in "00000000-00005964.00000000.180475.00C9B000.00000002.mdmp" Found system information discovery API: "X@GetEnvironmentStringsW" in "00000000-00005964.00000001.182398.00500000.00000004.mdmp" Found system information discovery API: "r@GetEnvironmentStringsW" in "00000000-00005964.00000001.182398.00500000.00000004.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005964.00000001.182398.40000000.00000040.mdmp, 00000000-00005964.00000002.184318.40000000.00000040.mdmp"33:Teec,"status is not in scan stategentraceback callback cannot be used with non-zero skipnewproc: function arguments too large for new goroutinereflect.FuncOf: last arg of variadic func must be slicereflect: internal error: invalid use of makeMethodValuefailed to allocate aligned heap memory; too many retriesin gcMark expecting to see gcphase as _GCmarkterminationprofilealloc called without" in Source: ec89ee06be23502099170957ded0f6e6706b8bccd83e37a83a02521e65d9d52f.bin "\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00005964.00000000.180475.00500000.00000004.mdmp 00000000-00005964.00000000.180475.40000000.00000040.mdmp 00000000-00005964.00000001.182398.00500000.00000004.mdmp 00000000-00005964.00000001.182398.40000000.00000040.mdmp 00000000-00005964.00000002.184318.40000000.00000040.mdmp 00000000-00005964.00000003.187495.40000000.00000040.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp 00000000-00005964.00000001.182398.7FB28000.00000004.mdmp 00000000-00005964.00000002.184318.7FB28000.00000004.mdmp 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "a Software\" in Source: 00000000-00005964.00000001.182398.7FB39000.00000004.mdmp "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00005964.00000001.182398.7FB49000.00000004.mdmp 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "\Opera Software\Opera Stable" in Source: 00000000-00005964.00000001.182398.7FB49000.00000004.mdmp 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "\Opera Software\Opera GX Stable" in Source: 00000000-00005964.00000001.182398.7FB49000.00000004.mdmp 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Default\" in Source: 00000000-00005964.00000001.182398.7FB49000.00000004.mdmp 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp ":\users\hapubws\appdata\local\bravesoftware\brave-browser\user data\local state" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\*.*" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "??\c:\users\hapubws\appdata\local\bravesoftware\brave-browser\user data\" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp "ocal\BraveSoftware\Brave-Browser\User Data\*.*" in Source: 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "ocal\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "??\c:\users\hapubws\appdata\local\bravesoftware\brave-browser\user data\default\" in Source: 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp ":\users\hapubws\appdata\roaming\opera software\opera gx stable\local state" in Source: 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\\*" in Source: 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\*.*" in Source: 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp "ta\Roaming\Opera Software\Opera GX Stable\*.*" in Source: 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Dy" in Source: 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp "aveSoftware\Brave-Bro" in Source: 00000000-00005964.00000003.187495.7FB3C000.00000004.mdmp "\BraveSoftware\Brave-Bro$`" in Source: 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\*.*" in Source: 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp44:T1f37,"\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00005964.00000000.180475.00500000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00005964.00000000.180475.40000000.00000040.mdmp "\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00005964.00000001.182398.00500000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00005964.00000001.182398.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005964.00000001.182398.7FA90000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005964.00000001.182398.7FB28000.00000004.mdmp "a Software\" in Source: 00000000-00005964.00000001.182398.7FB39000.00000004.mdmp "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00005964.00000001.182398.7FB49000.00000004.mdmp "\Opera Software\Opera Stable" in Source: 00000000-00005964.00000001.182398.7FB49000.00000004.mdmp "\Opera Software\Opera GX Stable" in Source: 00000000-00005964.00000001.182398.7FB49000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Default\" in Source: 00000000-00005964.00000001.182398.7FB49000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00005964.00000002.184318.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp ":\users\hapubws\appdata\local\bravesoftware\brave-browser\user data\local state" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\*.*" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "??\c:\users\hapubws\appdata\local\bravesoftware\brave-browser\user data\" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005964.00000002.184318.7FA90000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005964.00000002.184318.7FB28000.00000004.mdmp "ocal\BraveSoftware\Brave-Browser\User Data\*.*" in Source: 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp "ocal\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp "\Opera Software\Opera Stable" in Source: 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp "\Opera Software\Opera GX Stable" in Source: 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Default\" in Source: 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005964.00000002.184318.7FB49000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Local State" in Source: 00000000-00005964.00000003.187495.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp "\Opera Software\Opera Stable" in Source: 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp "\Opera Software\Opera GX Stable" in Source: 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp "??\c:\users\hapubws\appdata\local\bravesoftware\brave-browser\user data\default\" in Source: 00000000-00005964.00000003.187495.7FA90000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Default\" in Source: 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Dy " in Source: 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp ":\users\hapubws\appdata\roaming\opera software\opera gx stable\local state" in Source: 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\\*" in Source: 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\*.*" in Source: 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp "ta\Roaming\Opera Software\Opera GX Stable\*.*" in Source: 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp "S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005964.00000003.187495.7FAEF000.00000004.mdmp "aveSoftware\Brave-Bro" in Source: 00000000-00005964.00000003.187495.7FB3C000.00000004.mdmp "\BraveSoftware\Brave-Bro$`" in Source: 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Default\" in Source: 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "ocal\BraveSoftware\Brave-Browser\User Data\*.*" in Source: 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "ocal\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera GX Stable\*.*" in Source: 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "\Opera Software\Opera Stable" in Source: 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp "\Opera Software\Opera GX Stable" in Source: 00000000-00005964.00000003.187495.7FB40000.00000004.mdmp45:Tabd," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"697d2b43891c97520e08b436"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"