34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 59:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample ecdd7a7404a2… — Score 77/100 — Hybrid Analysis","description":"Malicious verdict for sample ecdd7a7404a2…. Malware family: Win/malicious_confidence_70%. Threat score 77/100. 4/28 AV engines flagged this file. 1 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2"],"about":{"@type":"SoftwareApplication","name":"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2","additionalType":"Malicious sample"},"threatScore":77,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":4,"total":28},"behavioralIndicators":{"malicious":1,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T969,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp")37:T86b,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp")38:T8e2,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp")39:T7d2,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp, 00000000-00007880.00000001.91256.18CBF000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp, 00000000-00007880.00000001.91256.18CBF000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007880.00000001.91256.18CBF000.00000002.mdmp")3a:T55c,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000000.91094.FBBE4000.00000004.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000000.91094.FBBE4000.00000004.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000000.91094.FBBE4000.00000004.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000000.91094.FBBE4000.00000004.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp")3b:T414,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= plugin" (Indicator: "CertOpenStore"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=1907348632812595367431640625i" (Indicator: "CertCloseStore"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=1907348632812595367431640625i" (Indicator: "CryptGenRandom"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "akeup298023223876953125value out of rangebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad index, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablerea" (Indicator: "CertOpenSystemStoreW"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablerea" (Indicator: "CryptAcquireContextW"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "ntgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=4656612873077392578125exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain" (Indicator: "CertGetCertificateChain"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unava" (Indicator: "CertFreeCertificateChain"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in fi" (Indicator: "CertFreeCertificateContext"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin"), Found api reference "nalizerfailed putFast after drainnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free obj" (Indicator: "CertCreateCertificateContext"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin"), Found api reference "684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin"), Found api reference "684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin"), Found api reference "goal cons/mark maxTrigger= pages/byte s.sweepgen= allocCount page summarybad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= plugi" (Indicator: "CertOpenStore"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=1907348632812595367431640625" (Indicator: "CertCloseStore"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=1907348632812595367431640625" (Indicator: "CryptGenRandom"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablere" (Indicator: "CertOpenSystemStoreW"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablere" (Indicator: "CryptAcquireContextW"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unav" (Indicator: "CertFreeCertificateChain"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in f" (Indicator: "CertFreeCertificateContext"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free ob" (Indicator: "CertCreateCertificateContext"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin"), Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp 00000000-00007880.00000001.91256.40000000.00000040.mdmp"), Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp 00000000-00007880.00000001.91256.40000000.00000040.mdmp"), Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp 00000000-00007880.00000001.91256.40000000.00000040.mdmp"), Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp 00000000-00007880.00000001.91256.40000000.00000040.mdmp"), Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp 00000000-00007880.00000001.91256.40000000.00000040.mdmp"), Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp 00000000-00007880.00000001.91256.40000000.00000040.mdmp"), Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp 00000000-00007880.00000001.91256.40000000.00000040.mdmp"), Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp 00000000-00007880.00000001.91256.40000000.00000040.mdmp"), Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp 00000000-00007880.00000001.91256.40000000.00000040.mdmp"), Found api reference "runtime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limit" (Indicator: "CertCloseStore"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limit" (Indicator: "CryptGenRandom"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp")3d:T41d,Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp")3e:T7ce,Contains base64 string in header "keep" in header "GET / HTTP/1.1Host: 179.61.227.32Cache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: 179.61.227.32Pragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0Content-Type: multipart/form-data; boundary=----pVLlPGbfwfUYe0lOSx8RCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "32Pragma" in header "POST / HTTP/1.1Host: 179.61.227.32Pragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0Content-Type: multipart/form-data; boundary=----pVLlPGbfwfUYe0lOSx8RCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: 179.61.227.32Pragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0Content-Type: multipart/form-data; boundary=----pVLlPGbfwfUYe0lOSx8RCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Host: 179.61.227.32Pragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0Content-Type: multipart/form-data; boundary=----pVLlPGbfwfUYe0lOSx8RCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: 179.61.227.32Pragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0Content-Type: multipart/form-data; boundary=----pVLlPGbfwfUYe0lOSx8RCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "data" in header "POST / HTTP/1.1Host: 179.61.227.32Pragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0Content-Type: multipart/form-data; boundary=----pVLlPGbfwfUYe0lOSx8RCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Host: 179.61.227.32Pragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0Content-Type: multipart/form-data; boundary=----pVLlPGbfwfUYe0lOSx8RCache-Control: no-cacheContent-Length: 254"3f:T2619,Found XOR loop in file "sample.bin" at offset 111770; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 939911; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 980640; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1001858; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1073927; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1124618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1144199; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1252628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1289182; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1382240; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1408632; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1807538; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2145496; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2145508; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2145532; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2146492; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2146540; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2147620; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2147824; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2147968; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2148112; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2148592; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2148940; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2149576; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2150272; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2151040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2151148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2151304; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2151400; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2153116; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2153620; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2153776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2154136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2154184; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2154892; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2155120; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2155132; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2155384; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2155984; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2156068; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2156092; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2156416; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2156968; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2157292; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2157304; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2158492; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2158588; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160280; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160544; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160640; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160652; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160676; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160700; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160712; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160724; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160748; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160760; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160772; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160784; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160808; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160820; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160832; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160844; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160856; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160892; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160904; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160928; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160940; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160988; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161024; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161036; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161048; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161072; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161084; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161108; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161132; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161144; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161156; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161168; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161228; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161288; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161348; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161408; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2161468; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 141373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 908014; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 925294; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 926254; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1122342; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1242231; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1271434; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1317495; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1317718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1334345; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1335178; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1343038; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1418326; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1464233; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1486858; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1936964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 214166; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 413277; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 439941; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 440637; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 441278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 773452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1033694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1034078; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1036517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1097734; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1152288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1199523; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1361919; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1389352; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1413171; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1414707; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1516380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1516764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1722633; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1834368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1838456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1876736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1919616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2100712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2188184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2197382; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2218334; code bytes = 803040:Ta4e,"g0= pad1= pad2= minpc= value= (scan)types : type 19531259765625invaliduintptrfloat32float64avx512fno anodecanceli" Heuristic match: "internal/abi.name.name" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.srcfunc.name" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Heuristic match: "amcommunity.com" Pattern match: "https://179.61.227.32" Pattern match: "https://telegram.me/k33dro" Pattern match: "https://steamcommunity.com/profiles/76561198732393960" Pattern match: "https://179.61.227.32/" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://schemas.microsoft.com/smi/2019/windowssettings" Heuristic match: "ntrust.net" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1$0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/mi"4d:T26f4,Found URL "https://179.61.227.32hellohttps://telegram.me/k33droi1i1kmozilla/5.0" - Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561198732393960i1i1kmozilla/5.0" - Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp") Found URL "https://179.61.227.32/rpc-2f6ef26f70e9241b3drpc-7ef4488518c17461fctlm" - Source: "00000000-00007880.00000000.91094.9B410000.00000004.mdmp") Found URL "https://179.61.227.32/f70e9241b3dhttps://179.61.227.32/17461fcmultipart/mixedmultipart/x-mixed-replacemultipart/x-byterangesasycasycasycasycasycasycasyc" - Source: "00000000-00007880.00000000.91094.9B410000.00000004.mdmp") Found URL "https://79.61.227.32------pvllpgbfwfuye0losx8rcontent-disposition:" - Source: "00000000-00007880.00000001.91256.367F9000.00000004.mdmp") Found URL "https://179.61.227.32" - Source: "00000000-00007880.00000001.91256.367F9000.00000004.mdmp") Found URL "https://179.61.227.32mozilla/5.023ebd35be7f8d3c20da4-d27478a5-2058aeea2a0dc60b4a0f34ca91d35f7559e2cvve5c:\programdata\cvve5" - Source: "00000000-00007880.00000001.91256.367F9000.00000004.mdmp") Found URL "https://179.61.227.32hellohttps://telegram.me/k33droi1i1kmozilla/5.0" - Source: "00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561198732393960i1i1kmozilla/5.0" - Source: "00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found URL "https://179.61.227.32/rpc-2f6ef26f70e9241b3drpc-7ef4488518c17461fctlm" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "https://179.61.227.32/f70e9241b3dhttps://179.61.227.32/17461fcmultipart/mixedmultipart/x-mixed-replacemultipart/x-byterangesasycasycasycasycasycdecdasycasyc" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "https://179.61.227.32/61.2default" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "https://179.61.227.32/esscontenthintdecodeex1.3.6.1.5.5.7.1.11.2.840.113549.1.1.41.3.6.1.4.1.311.20.2essmlhistorydecodeex2.16.840.1.113730.1.11.2.840.113549.1.1.21.2.840.113549.1.1.12x509essreceiptdecodeex1.3.6.1.4.1.311.21.1osof" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czco!yjthawte," - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mi11-03-29.crl0]ilgb&" - Source: "00000000-00007880.00000001.91256.9B410000.00000004.mdmp")4e:T70d,Found registry query API: "RegOpenKey (in long string)" in file "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin" Found registry query API: "RegQueryValue (in long string)" in file "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin" Found registry query API: "RegOpenKeyExA" in "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp" Found registry query API: "RegGetValueW" in "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp" Found registry query API: "RegOpenKey (in long string)" in "00000000-00007880.00000001.91256.18B06000.00000002.mdmp" Found registry query API: "RegQueryValue (in long string)" in "00000000-00007880.00000001.91256.18B06000.00000002.mdmp"4f:Teb1,Found string "chacha8" (Indicator: "chacha"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "aes"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "aeshashbody" (Indicator: "aes"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "internal/chacha8rand/chacha8_amd64.s" (Indicator: "chacha"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "runtime.useAeshash" (Indicator: "aes"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "runtime.aeskeysched" (Indicator: "aes"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found string "chacha8" (Indicator: "chacha"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") Found string "*chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") Found string "internal/chacha8rand" (Indicator: "chacha"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") Found string "pc= G125625NaNintadxaesshaavxfmabindallgallprootitabsbrkidledeadsync is LEAFheapbase at Has of ) = <==GOGC] = pc=true: p=cas1cas2cas3cas4cas5cas6" (Indicator: "aes"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp, 00000000-00007880.00000001.91256.18CBF000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp, 00000000-00007880.00000001.91256.18CBF000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp, 00000000-00007880.00000001.91256.18CBF000.00000002.mdmp")50:T532,file/memory contains long string with (Indicator: "FindNextFile"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "FindFirstFile"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "FindNextFile"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") file/memory contains long string with (Indicator: "FindFirstFile"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp")51:Tf12,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "Process32First"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp")52:T67a,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "GetProcAddress"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "GetProcAddress"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp, 00000000-00007880.00000001.91256.18CBF000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp, 00000000-00007880.00000001.91256.18CBF000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007880.00000001.91256.18CBF000.00000002.mdmp")53:T7ad,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp")54:T9ba,file/memory contains long string with (Indicator: "GetUserName"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp")55:T489,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "ExitProcess"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") file/memory contains long string with (Indicator: "TerminateProcess"; File: "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "TerminateProcess"; Source: "00000000-00007880.00000001.91256.18B06000.00000002.mdmp")56:Ta2d," HTTP/1.1 200 OK\nServer: nginx\nDate: Wed\n 11 Mar 2026 14:41:01 GMT\nContent-Type: text/html; charset=UTF-8\nTransfer-Encoding: chunked\nConnection: keep-alive with response body ==>6F6B.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\" wbuf2= gcscandone runtime: gp= found at *( s.elemsize=scan: total scan: class B (\" (Indicator: \"ping \"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"setsockopt\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /\"\n Found http requests in header \"POST /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"CreatePipe\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"setsockopt\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"179.61.227.32\"\n Potential IP \"179.61.227.32\" found in string \"https://179.61.227.32\"\n Potential IP \"179.61.227.32\" found in string \"ttps://179.61.227.32/\"\n \"79.61.227.32\"\n Potential IP \"179.61.227.32\" found in string \"https://179.61.227.32/\"\n Potential IP \"179.61.227.32\" found in string \"Host: 179.61.227.32\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.14\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.32\"\n \"2.5.29.15\"\n \"2.5.29.19\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")\n Found string \"GET / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007880.00000000.91094.9B410000.00000004.mdmp\")\n Found string \"User-AgentMozilla/5.0GET / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007880.00000000.91094.9B410000.00000004.mdmp\")\n Found string \"POST / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007880.00000001.91256.9B410000.00000004.mdmp\")\n Found string \"Content-Length254POST / HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007880.00000001.91256.9B410000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007880.00000001.91256.9B410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET / HTTP/1.1\nHost: 179.61.227.32\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 8e6e5e26c545781f412f07aaaef7d20a","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://179.61.227.32/\n Found HTTPS POST request to https://179.61.227.32/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"179.61.227.32\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopA\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00007880.00000000.91094.9B410000.00000004.mdmp, 00000000-00007880.00000001.91256.9B410000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00007880.00000000.91094.9B410000.00000004.mdmp, 00000000-00007880.00000001.91256.9B410000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007880.00000000.91094.9B410000.00000004.mdmp, 00000000-00007880.00000001.91256.9B410000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00007880.00000000.91094.9B410000.00000004.mdmp, 00000000-00007880.00000001.91256.9B410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateDCA\" (Indicator: \"CreateDC\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"runtime._RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n Found reference to API \"runtime._RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007880.00000001.91256.18CBF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"LookupAccountName\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"Found reference to API \"GetCurrentHwProfileA\" (Indicator: \"GetCurrentHwProfile\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"GetComputerName\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secret\" (Indicator: \"secret\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n Found string \"secret\" (Indicator: \"secret\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping heapchan receivesynctest.Runcleanup wait span.limit= span.state=bad flushGen MB stacks, worker mode nDataRoots= nSpanRoots= wbuf1= wbuf2= gcscandone runtime: gp= found at *( s.elemsize=scan: total scan: class B (\" (Indicator: \"ping\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"route\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n Found string \"HostName\" (Indicator: \"hostname\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000000.91094.FBBE4000.00000004.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"route\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007880.00000000.91094.9B410000.00000004.mdmp, 00000000-00007880.00000001.91256.9B410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"SetFileAttributes\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"file/memory contains long string with (Indicator: \"CopySid\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"GetLengthSid\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n Found reference to API \"m=nil base 390625uint16uint32uint64rdtscppopcntCommonUNKNOWNCopySidWSARecvWSASendconnectforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkcleanup, goid= mark s=nil\" (Indicator: \"CopySid\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007880.00000000.91094.40000000.00000040.mdmp, 00000000-00007880.00000001.91256.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\")\n file/memory contains long string with (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00007880.00000001.91256.18B06000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00007880.00000001.91256.9B410000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"remove\" (Source: ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin, API is part of module: UCRTBASE.DLL)\n Found string \"NtCancelWaitCompletionPacket\" (Source: ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin, API is part of module: NTDLL.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/27 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"\"POST / HTTP/1.1\nHost: 179.61.227.32\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0\nContent-Type: multipart/form-data; boundary=----pVLlPGbfwfUYe0lOSx8R\nCache-Control: no-cache\nContent-Length: 254\" with payload::==> \"------pVLlPGbfwfUYe0lOSx8RContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058------pVLlPGbfwfUYe0lOSx8RContent-Disposition: form-data; name=\"build_id\"aeea2a0dc60b4a0f34ca91d35f7559e2------pVLlPGbfwfUYe0lOSx8R--\" HTTP/1.1 200 OK\nServer: nginx\nDate: Wed\n 11 Mar 2026 14:41:02 GMT\nContent-Type: text/html; charset=UTF-8\nTransfer-Encoding: chunked\nConnection: keep-alive with response body ==>626C6F636B.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00007880.00000000.91094.E0BC0000.00000002.mdmp\n \"!Progman\" (Program manager) in Source: 00000000-00007880.00000000.91094.E0BC0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 179.61.227.32 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA\" matched process \"00000000-00007880\" as \"Detects Windows executables referencing non-Windows User-Agents\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\" \"------pVLlPGbfwfUYe0lOSx8RContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058------pVLlPGbfwfUYe0lOSx8RContent-Disposition: form-data; name=\"build_id\"aeea2a0dc60b4a0f34ca91d35f7559e2------pVLlPGbfwfUYe0lOSx8R--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":57,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"69b17ed8bb62074cf50a0f0d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":77,"malware_family":"Agent.LWI.gen","contacted_countries":["IND"],"submit_name":"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin","analysis_start_time":"2026-03-11T14:40:25+00:00","indicators_count":{"informative":162,"suspicious":26,"malicious":1},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"179.61.227.32","port":443,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]}],"dns_resolutions":null,"http_requests":[{"host":"179.61.227.32","host_ip":"179.61.227.32:443","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: 179.61.227.32\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}],"processes":[{"pid":7880,"ppid":0,"name":"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin.exe","command_line":"","sha256":"ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2","normalized_path":"C:\\ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.bin.exe","uid":"00000000-00007880","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["KernelBase.dll","crypt32.dll","iertutil.dll","imagehlp.dll","user32.dll","ole32.dll","SHCore.dll","kernel.appcore.dll","winnsi.dll","bcryptprimitives.dll","msvcp_win.dll","GdiPlus.dll","windows.storage.dll","profapi.dll","OnDemandConnRouteHelper.dll","wintrust.dll","winhttp.dll","urlmon.dll","cryptbase.dll","mskeyprotect.dll","ntdll.dll","shell32.dll","mswsock.dll","rsaenh.dll","gdi32full.dll","sspicli.dll","ncryptsslp.dll","msIso.dll","shlwapi.dll","schannel.dll","gpapi.dll","imm32.dll","sechost.dll","dpapi.dll","kernel32.dll","gdi32.dll","advapi32.dll","msasn1.dll","rpcrt4.dll","ws2_32.dll","IPHLPAPI.DLL","cryptsp.dll","cryptnet.dll","cfgmgr32.dll","win32u.dll","powrprof.dll","oleaut32.dll","ntasn1.dll","winmm.dll","winmmbase.dll","combase.dll","bcrypt.dll","nsi.dll","ncrypt.dll","msvcrt.dll","ucrtbase.dll","wininet.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"69b17ed8bb62074cf50a0f0d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["69b17ed8bb62074cf50a0f0d"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample ecdd7a7404a2… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ecdd7a7404a2…. Malware family: Win/malicious_confidence_70%. Threat score 77/100. 4/28 AV engines flagged this file. 1 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample ecdd7a7404a2… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ecdd7a7404a2…. Malware family: Win/malicious_confidence_70%. Threat score 77/100. 4/28 AV engines flagged this file. 1 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample ecdd7a7404a2… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ecdd7a7404a2…. Malware family: Win/malicious_confidence_70%. Threat score 77/100. 4/28 AV engines flagged this file. 1 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L59","11",{}]] 32:null