24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4cb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample fd240746ebef… — Score 88/100 — Hybrid Analysis","description":"Malicious verdict for sample fd240746ebef…. Malware family: Win/malicious_confidence_90%. Threat score 88/100. 5/25 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fd240746ebef01cd378b4ffea19cdf139d44960caf41f88dce4bbab8faceb7d7","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","fd240746ebef01cd378b4ffea19cdf139d44960caf41f88dce4bbab8faceb7d7"],"about":{"@type":"SoftwareApplication","name":"fd240746ebef01cd.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"fd240746ebef01cd378b4ffea19cdf139d44960caf41f88dce4bbab8faceb7d7","additionalType":"Malicious sample"},"threatScore":88,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":5,"total":25},"behavioralIndicators":{"malicious":3,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T538,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "fd240746ebef01cd.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "fd240746ebef01cd.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "GetTickCount64"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "GetTickCount64"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp")26:T66f,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "fd240746ebef01cd.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "fd240746ebef01cd.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "fd240746ebef01cd.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "fd240746ebef01cd.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "fd240746ebef01cd.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006728.00000000.232564.00080000.00000004.mdmp") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp, 00000000-00006728.00000000.232564.00ADC000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp, 00000000-00006728.00000000.232564.00ADC000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006728.00000000.232564.00ADC000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp")27:T42c,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersgotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQuerynot pollableCreateActCtxW%*sexit left6f5e4d3c2b1a7level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitout of memory is nil, not value method bad map state span.base()=bad flushGen , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase" (Indicator: "CertOpenStore"; File: "fd240746ebef01cd.bin") Found api reference "}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=gocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtx peak index: %*sexit rightxml error: %vfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.Pointer on zero Valueunknown methodinvalid syntax1907348632812595367431640625userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CertCloseStore"; File: "fd240746ebef01cd.bin") Found api reference "}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=gocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtx peak index: %*sexit rightxml error: %vfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.Pointer on zero Valueunknown methodinvalid syntax1907348632812595367431640625userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CryptGenRandom"; File: "fd240746ebef01cd.bin") Found api reference "eemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupx509negativeserialQueryServiceStatusGetComputerNameExWuse of closed fileRtlAddFunctionTableGetCurrentProcessId%*sexit projectionreflect.Value.IsNilreflect.Value.Floatbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWWaitForSingleObjectreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125GC mark terminationwait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesbad kind in runfinqmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpa" (Indicator: "CryptReleaseContext"; File: "fd240746ebef01cd.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedmultipartmaxheadersSetTokenInformationMultiByteToWideCharinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsreflect.Value.IsZero37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesmalloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: ph" (Indicator: "CertOpenSystemStoreW"; File: "fd240746ebef01cd.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedmultipartmaxheadersSetTokenInformationMultiByteToWideCharinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsreflect.Value.IsZero37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesmalloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: ph" (Indicator: "CryptAcquireContextW"; File: "fd240746ebef01cd.bin") Found api reference "invalidcompileCallback: type non-Go function at pc=exit hook invoked exitRtlLookupFunctionEntryCreateEnvironmentBlockWSAGetOverlappedResultSetEnvironmentVariableW first zero position: xml: unsupported type: device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTime" missing CPU supportbytes.Buffer: too largereflect.Value.Interfacereflect.Value.NumMethod23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channel) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic duri" (Indicator: "CertGetCertificateChain"; File: "fd240746ebef01cd.bin") Found api reference "ng preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallexit hook invoked panicDestroyEnvironmentBlockpattern bits too long: NtQueryInformationThreadconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryW116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpe" (Indicator: "CertFreeCertificateChain"; File: "fd240746ebef01cd.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartinconsistent poll.fdMutexExpandEnvironmentStringsWreflect.Value.CanInterfaceinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatus using unaddressable valueunknown ABI parameter kind1455191522836685180664062572759576141834259033203125all goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - doub" (Indicator: "CertFreeCertificateContext"; File: "fd240746ebef01cd.bin") Found api reference "le wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorySetFileInformationByHandleAddVectoredExceptionHandlerxml: start tag with no namechannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorereflect.Value.UnsafePointer is not assignable to type 363797880709171295166015625PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedruntime" (Indicator: "CertEnumCertificatesInStore"; File: "fd240746ebef01cd.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for abi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext18189894035458564758300781259094947017729282379150390625GC mark assist wait for work" (Indicator: "CertCreateCertificateContext"; File: "fd240746ebef01cd.bin") Found api reference "-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeassert end matched=%t mobius=%tresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy" not supported for cpu option "MapIter.Value called before Next28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "fd240746ebef01cd.bin") Found api reference "-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeassert end matched=%t mobius=%tresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy" not supported for cpu option "MapIter.Value called before Next28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "fd240746ebef01cd.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersgotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQuerynot pollableCreateActCtxW%*sexit left6f5e4d3c2b1a7level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitout of memory is nil, not value method bad map state span.base()=bad flushGen , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbas" (Indicator: "CertOpenStore"; File: "fd240746ebef01cd.bin") Found api reference "eemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupx509negativeserialQueryServiceStatusGetComputerNameExWuse of closed fileRtlAddFunctionTableGetCurrentProcessId%*sexit projectionreflect.Value.IsNilreflect.Value.Floatbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWWaitForSingleObjectreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125GC mark terminationwait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesbad kind in runfinqmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocp" (Indicator: "CryptReleaseContext"; File: "fd240746ebef01cd.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedmultipartmaxheadersSetTokenInformationMultiByteToWideCharinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsreflect.Value.IsZero37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesmalloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: p" (Indicator: "CertOpenSystemStoreW"; File: "fd240746ebef01cd.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedmultipartmaxheadersSetTokenInformationMultiByteToWideCharinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsreflect.Value.IsZero37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesmalloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: p" (Indicator: "CryptAcquireContextW"; File: "fd240746ebef01cd.bin") Found api reference "invalidcompileCallback: type non-Go function at pc=exit hook invoked exitRtlLookupFunctionEntryCreateEnvironmentBlockWSAGetOverlappedResultSetEnvironmentVariableW first zero position: xml: unsupported type: device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTime" missing CPU supportbytes.Buffer: too largereflect.Value.Interfacereflect.Value.NumMethod23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channel) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic dur" (Indicator: "CertGetCertificateChain"; File: "fd240746ebef01cd.bin") Found api reference "ng preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallexit hook invoked panicDestroyEnvironmentBlockpattern bits too long: NtQueryInformationThreadconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryW116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexp" (Indicator: "CertFreeCertificateChain"; File: "fd240746ebef01cd.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartinconsistent poll.fdMutexExpandEnvironmentStringsWreflect.Value.CanInterfaceinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatus using unaddressable valueunknown ABI parameter kind1455191522836685180664062572759576141834259033203125all goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - dou" (Indicator: "CertFreeCertificateContext"; File: "fd240746ebef01cd.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for abi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext18189894035458564758300781259094947017729282379150390625GC mark assist wait for wor" (Indicator: "CertCreateCertificateContext"; File: "fd240746ebef01cd.bin") Found api reference "6f5e4d3c2b1a7level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitout of memory is nil, not value method bad map state span.base()=bad flushGen , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}" (Indicator: "CertOpenStore"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found api reference "file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.Pointer on zero Valueunknown methodinvalid syntax1907348632812595367431640625userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found api reference "file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.Pointer on zero Valueunknown methodinvalid syntax1907348632812595367431640625userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found api reference "reflect.Value.IsNilreflect.Value.Floatbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWWaitForSingleObjectreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125GC mark terminationwait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesbad kind in runfinqmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedmultipartmaxheadersSetTokenInformationMultiByteToWideCharinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsreflect.Value.IsZero37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesmalloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedmultipartmaxheadersSetTokenInformationMultiByteToWideCharinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsreflect.Value.IsZero37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesmalloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found api reference "the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallexit hook invoked panicDestroyEnvironmentBlockpattern bits too long: NtQueryInformationThreadconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryW116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found api reference "resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy" not supported for cpu option "MapIter.Value called before Next28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found api reference "resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy" not supported for cpu option "MapIter.Value called before Next28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp")29:Tba1,Observed string: "crypto/sha1" (Indicator: "crypto/sha1") in Source: fd240746ebef01cd.bin Observed string: "crypto/internal/boring/sig.StandardCrypto" (Indicator: "crypto/internal/boring/sig.StandardCrypto") in Source: fd240746ebef01cd.bin Observed string: "crypto/sha1.init" (Indicator: "crypto/sha1.init") in Source: fd240746ebef01cd.bin Observed string: "crypto/sha1.init.0" (Indicator: "crypto/sha1.init.0") in Source: fd240746ebef01cd.bin Observed string: "crypto/sha1.New" (Indicator: "crypto/sha1.New") in Source: fd240746ebef01cd.bin Observed string: "crypto/sha1.(*digest).Reset" (Indicator: "crypto/sha1.(*digest).Reset") in Source: fd240746ebef01cd.bin, Observed string: "crypto/sha1.(*digest).Write" (Indicator: "crypto/sha1.(*digest).Write") in Source: fd240746ebef01cd.bin, Observed string: "crypto/internal/boring.Unreachable" (Indicator: "crypto/internal/boring.Unreachable") in Source: fd240746ebef01cd.bin, Observed string: "crypto/sha1.(*digest).checkSum" (Indicator: "crypto/sha1.(*digest).checkSum") in Source: fd240746ebef01cd.bin, Observed string: "crypto/sha1.Sum" (Indicator: "crypto/sha1.Sum") in Source: fd240746ebef01cd.bin, Observed string: "crypto/sha1.block" (Indicator: "crypto/sha1.block") in Source: fd240746ebef01cd.bin, Observed string: "crypto/sha1.blockAMD64" (Indicator: "crypto/sha1.blockAMD64") in Source: fd240746ebef01cd.bin, Observed string: "crypto/sha1.blockAVX2" (Indicator: "crypto/sha1.blockAVX2") in Source: fd240746ebef01cd.bin, Observed string: "type:.eq.crypto/sha1.digest" (Indicator: "type:.eq.crypto/sha1.digest") in Source: fd240746ebef01cd.bin, Observed string: "crypto/crypto.go" (Indicator: "crypto/crypto.go") in Source: fd240746ebef01cd.bin, Observed string: "crypto/internal/boring/sig/sig_amd64.s" (Indicator: "crypto/internal/boring/sig/sig_amd64.s") in Source: fd240746ebef01cd.bin, Observed string: "crypto/sha1/sha1block_amd64.go" (Indicator: "crypto/sha1/sha1block_amd64.go") in Source: fd240746ebef01cd.bin, Observed string: "crypto/sha1/sha1.go" (Indicator: "crypto/sha1/sha1.go") in Source: fd240746ebef01cd.bin, Observed string: "crypto/internal/boring/notboring.go" (Indicator: "crypto/internal/boring/notboring.go") in Source: fd240746ebef01cd.bin, Observed string: "crypto/sha1/sha1block_amd64.s" (Indicator: "crypto/sha1/sha1block_amd64.s") in Source: fd240746ebef01cd.bin, Observed string: "crypto/internal/boring/sig.StandardCrypto.abi0" (Indicator: "crypto/internal/boring/sig.StandardCrypto.abi0") in Source: fd240746ebef01cd.bin, Observed string: "crypto/sha1.blockAMD64.abi0" (Indicator: "crypto/sha1.blockAMD64.abi0") in Source: fd240746ebef01cd.bin, Observed string: "crypto/sha1.blockAVX2.abi0" (Indicator: "crypto/sha1.blockAVX2.abi0") in Source: fd240746ebef01cd.bin, Observed string: "crypto/sha1..inittask" (Indicator: "crypto/sha1..inittask") in Source: fd240746ebef01cd.bin, Observed string: "crypto/sha1.useAVX2" (Indicator: "crypto/sha1.useAVX2") in Source: fd240746ebef01cd.bin2a:T80a,Contains base64 string in header "POST" in header "POST /comments HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "Keep" in header "POST /comments HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "cacheContent" in header "POST /comments HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "Type" in header "POST /comments HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "form" in header "POST /comments HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "like" in header "POST /comments HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89"2b:Tbd3,Found XOR loop in file "sample.bin" at offset 73040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1738316; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1738372; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2600672; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2900849; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2902897; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3651892; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4136031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2910913; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2996994; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3023070; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3083173; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3770204; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 160854; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 354072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 389385; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1453681; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1453719; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1453754; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1665732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2293032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2294568; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2294760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2346576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2552350; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2552853; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2577449; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2580237; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2654999; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2659115; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2941057; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3009153; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3660820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3701512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3862776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3916264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4062815; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4097845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4129772; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4146651; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4151332; code bytes = 80302c:T5d0,file/memory contains long string with (Indicator: "GetCommandLine"; File: "fd240746ebef01cd.bin") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; File: "fd240746ebef01cd.bin") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; File: "fd240746ebef01cd.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00006728-00000C2C-2053366712") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00006728-00000C2C-2053563261") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00006728.00000000.232564.00080000.00000004.mdmp, 00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00006728.00000000.232564.00080000.00000004.mdmp, 00000000-00006728.00000000.232564.00180000.00000004.mdmp, 00000000-00006728.00000000.232564.40000000.00000040.mdmp, 00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCommandLine"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp, 00000000-00006728.00000000.232564.00ADC000.00000002.mdmp") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00006728.00000000.232564.00ADC000.00000002.mdmp")2d:T9f2,"xmlniladxaesshaavxfmaEOFmapptr...125625NaNfinobjgc %: gp *(in n= )" (Indicator: "aes"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") file/memory contains long string with (Indicator: "3des"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp")40:Ta88,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "Module32Next"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "Process32First"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "Module32First"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "Module32Next"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") file/memory contains long string with (Indicator: "Module32First"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found reference to API ", locked to threadruntime.semacreateruntime.semawakeupx509negativeserialQueryServiceStatusGetComputerNameExWuse of closed fileRtlAddFunctionTableGetCurrentProcessId%*sexit projection" (Indicator: "GetCurrentProcess"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp")41:T592,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "GetProcAddress"; File: "fd240746ebef01cd.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "fd240746ebef01cd.bin") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "fd240746ebef01cd.bin") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "fd240746ebef01cd.bin") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006728.00000000.232564.00080000.00000004.mdmp, 00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") file/memory contains long string with (Indicator: "GetProcAddress"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp, 00000000-00006728.00000000.232564.00ADC000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp, 00000000-00006728.00000000.232564.00ADC000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006728.00000000.232564.00ADC000.00000002.mdmp")42:Tc17,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "fd240746ebef01cd.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "fd240746ebef01cd.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTempPath"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found reference to API "wGetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp")43:T426,file/memory contains long string with (Indicator: "GetComputerName"; File: "fd240746ebef01cd.bin") Found reference to API "GetComputerNameA" (Indicator: "GetComputerName"; Source: "00000000-00006728.00000000.232564.00080000.00000004.mdmp, 00000000-00006728.00000000.232564.00180000.00000004.mdmp, 00000000-00006728.00000000.232564.40000000.00000040.mdmp") Found reference to API "GetComputerNameExA" (Indicator: "GetComputerName"; Source: "00000000-00006728.00000000.232564.00080000.00000004.mdmp, 00000000-00006728.00000000.232564.00180000.00000004.mdmp, 00000000-00006728.00000000.232564.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "GetComputerName"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found reference to API ", locked to threadruntime.semacreateruntime.semawakeupx509negativeserialQueryServiceStatusGetComputerNameExWuse of closed fileRtlAddFunctionTableGetCurrentProcessId%*sexit projection" (Indicator: "GetComputerName"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp")44:T8c6,file/memory contains long string with (Indicator: "CopySid"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "GetLengthSid"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "RevertToSelf"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "DuplicateToken"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "fd240746ebef01cd.bin") file/memory contains long string with (Indicator: "CopySid"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found reference to API "runtime: sp=abi mismatchwrong timersgotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQuerynot pollableCreateActCtxW%*sexit left" (Indicator: "RevertToSelf"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found reference to API "morebuf={pc:: no frame (sp=runtime: frame ts set in timertraceback stuckjstmpllitinterptarinsecurepathx509keypairleafx509usepolicieszipinsecurepathImpersonateSelfOpenThreadTokenRegCreateKeyExWRegDeleteValueWGetCurrentThread%*sexit matched" (Indicator: "ImpersonateSelf"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found reference to API "DuplicateTokenExRtlVirtualUnwind%*senter unknown" (Indicator: "DuplicateToken"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") Found reference to API "DuplicateTokenExRtlVirtualUnwind%*senter unknown" (Indicator: "DuplicateTokenEx"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp") file/memory contains long string with (Indicator: "SetTokenInformation"; Source: "00000000-00006728.00000000.232564.008F2000.00000002.mdmp")45:T8c2,"\" - Source: \"00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp\")\n Found URL \"http://peakpark.click:2525/commentspeakpark.clickpeakpark.clickpschedvmbusafunixrfcommcalrpc:[ntsvcs]rpc\" - Source: \"00000000-00006728.00000000.232564.96E28000.00000004.mdmp\")\n Found URL \"http://peakpark.click:2525/commentsnegoextender\" - Source: \"00000000-00006728.00000000.232564.96E28000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST /comments HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006728.00000000.232564.96E28000.00000004.mdmp\")\n Found string \"HTTP/1.1 405 Not Allowed\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006728.00000000.232564.96E39000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://peakpark.click:2525\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00006728.00000000.232564.00080000.00000004.mdmp, 00000000-00006728.00000000.232564.00180000.00000004.mdmp, 00000000-00006728.00000000.232564.40000000.00000040.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLED49E85135F7DB056EE1614F9BB47]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006728.00000000.232564.96DA0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006728.00000000.232564.96DA0000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLED49E85135F7DB056EE1614F9BB47]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006728.00000000.232564.96DA0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE466ADACAD955C1E8098CA5B8E065]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006728.00000000.232564.96DA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006728.00000000.232564.96DA0000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006728.00000000.232564.96DA0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00006728.00000000.232564.96DA0000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006728.00000000.232564.96DA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"fd240746ebef01cd.bin\")\n Found reference to API \"runtime._RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"fd240746ebef01cd.bin\")\n Found reference to API \"internal/syscall/windows.procRtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"fd240746ebef01cd.bin\")\n file/memory contains long string with (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006728.00000000.232564.008F2000.00000002.mdmp\")\n Found reference to API \"runtime._RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006728.00000000.232564.00ADC000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procRtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006728.00000000.232564.00ADC000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKey (in long string)\" in file \"fd240746ebef01cd.bin\"\n Found registry query API: \"RegEnumValue (in long string)\" in file \"fd240746ebef01cd.bin\"\n Found registry query API: \"RegQueryValue (in long string)\" in file \"fd240746ebef01cd.bin\"\n Found registry query API: \"RegOpenKey (in long string)\" in \"00000000-00006728.00000000.232564.008F2000.00000002.mdmp\"\n Found registry query API: \"RegEnumValue (in long string)\" in \"00000000-00006728.00000000.232564.008F2000.00000002.mdmp\"\n Found registry query API: \"RegQueryValue (in long string)\" in \"00000000-00006728.00000000.232564.008F2000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00006728.00000000.232564.6E5E3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"fd240746ebef01cd.bin\" has section name .rsrc with entropy \"7.987933986551063\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads VM-specific registry key","description":"\" \"tag=5c07e21ca557de9ff0ce91d009c62e00&exp=1791989750&hwid=16ce7935c19ac46135516e79f8054255\" HTTP/1.1 405 Not Allowed\nDate: Thu\n 15 Oct 2026 21:57:09 GMT\nContent-Type: text/html\nContent-Length: 55\nConnection: keep-alive\nServer: nginx\nAllow: GET\n HEAD with response body ==>00C3A3C2B64C1E005FC3BEC2B9785E20C390C398C3AEC2AA16C3893141C38865C3AC4256C3A1C396C3A5C2A76CC3913755730977C3A473C38963C38907C2B633.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00006728.00000000.232564.96DA0000.00000004.mdmp\")\n Found string \"hWMI.ExecQuery(SELECT * FROM Win32_VideoController);\" (Indicator: \"wmi.exe\"; in Source: \"00000000-00006728.00000000.232564.96DA0000.00000004.mdmp\")\n Found string \"^WMI.ExecQuery(SELECT * FROM AntiVirusProduct);\" (Indicator: \"wmi.exe\"; in Source: \"00000000-00006728.00000000.232564.96DA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"fd240746ebef01cd.bin\" claimed CRC 741200397 while the actual is CRC 4442392","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetThreadContext\n GetSystemInfo\n LoadLibraryW\n LoadLibraryExW\n CreateThread\n GetProcAddress\n VirtualAlloc\n GetSystemDirectoryA\n WriteFile","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"fd240746ebef01cd.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\" \"tag=5c07e21ca557de9ff0ce91d009c62e00&exp=1791989750&hwid=16ce7935c19ac46135516e79f8054255\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Reads VM-specific registry key"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]}],"intel_graph":{"map":{"Domain:github.com":{"type":"Domain","value":"github.com"},"Domain:peakpark.click":{"type":"Domain","value":"peakpark.click"},"File:fd240746ebef01cd378b4ffea19cdf139d44960caf41f88dce4bbab8faceb7d7":{"type":"File","value":"fd240746ebef01cd378b4ffea19cdf139d44960caf41f88dce4bbab8faceb7d7"},"Ip:46.249.101.141":{"type":"Ip","value":"46.249.101.141"},"Url:/comments":{"type":"Url","value":"/comments"}},"chains":[{"id":"sandbox_network","root":"File:fd240746ebef01cd378b4ffea19cdf139d44960caf41f88dce4bbab8faceb7d7","edges":[{"edge_kind":"contacted_ip","from_key":"File:fd240746ebef01cd378b4ffea19cdf139d44960caf41f88dce4bbab8faceb7d7","to_key":"Ip:46.249.101.141"},{"edge_kind":"contacted_domain","from_key":"File:fd240746ebef01cd378b4ffea19cdf139d44960caf41f88dce4bbab8faceb7d7","to_key":"Domain:github.com"},{"edge_kind":"contacted_domain","from_key":"File:fd240746ebef01cd378b4ffea19cdf139d44960caf41f88dce4bbab8faceb7d7","to_key":"Domain:peakpark.click"},{"edge_kind":"resolves_to","from_key":"Domain:peakpark.click","to_key":"Ip:46.249.101.141"},{"edge_kind":"contacted_url","from_key":"File:fd240746ebef01cd378b4ffea19cdf139d44960caf41f88dce4bbab8faceb7d7","to_key":"Url:/comments"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":53,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["suspicious","new_domain","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6ad14c12438a4ece6303c51e","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":88,"malware_family":"WinGo.J.gen","contacted_countries":["DEU"],"submit_name":"fd240746ebef01cd.bin","analysis_start_time":"2026-10-15T21:56:36+00:00","indicators_count":{"informative":163,"suspicious":32,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"46.249.101.141","port":2525,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]}],"dns_resolutions":[{"domain":"github.com","country":"-","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"domain":"peakpark.click","address":"46.249.101.141","ttl":300,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]}],"http_requests":[{"host":"github.com","host_ip":"46.249.101.141:2525","url":"/comments","method":"POST","response_code":"405","response_phrase":"Not Allowed","header":"POST /comments HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nHost: github.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\nContent-Length: 89","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}],"processes":[{"pid":6728,"ppid":0,"name":"fd240746ebef01cd.bin.exe","command_line":"","sha256":"fd240746ebef01cd378b4ffea19cdf139d44960caf41f88dce4bbab8faceb7d7","normalized_path":"C:\\fd240746ebef01cd.bin.exe","uid":"00000000-00006728","icon":"$46"}],"all_imported_dlls":["ntdll.dll","user32.dll","msvcp_win.dll","fastprox.dll","version.dll","sspicli.dll","FWPUCLNT.DLL","KernelBase.dll","ws2_32.dll","rpcrt4.dll","cryptsp.dll","clbcatq.dll","amsi.dll","MpOAV.dll","rasadhlp.dll","msvcp140.dll","combase.dll","VxSSL64.dll","fltLib.dll","ucrtbase.dll","vcruntime140_1.dll","oleaut32.dll","advapi32.dll","sechost.dll","winhttp.dll","gdi32.dll","shlwapi.dll","umpdc.dll","uxtheme.dll","wbemprox.dll","OnDemandConnRouteHelper.dll","webio.dll","IPHLPAPI.DLL","win32u.dll","gdi32full.dll","userenv.dll","winnsi.dll","dnsapi.dll","kernel32.dll","apphelp.dll","imm32.dll","kernel.appcore.dll","oqZd7o81.dll","mswsock.dll","nsi.dll","vcruntime140.dll","ole32.dll","msvcrt.dll","bcryptprimitives.dll","powrprof.dll","wbemcomn.dll","wbemsvc.dll","profapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"path":"\"C:\\fd240746ebef01cd.bin.exe\"","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"name":"SM0:6728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"name":"Local\\SM0:6728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"name":"SM0:6728:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6728:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad14c12438a4ece6303c51e"}]}]}},"report_ids":{"sandbox_job_ids":["6ad14c12438a4ece6303c51e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample fd240746ebef… — Score 88/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fd240746ebef…. Malware family: Win/malicious_confidence_90%. Threat score 88/100. 5/25 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fd240746ebef01cd378b4ffea19cdf139d44960caf41f88dce4bbab8faceb7d7"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample fd240746ebef… — Score 88/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fd240746ebef…. Malware family: Win/malicious_confidence_90%. Threat score 88/100. 5/25 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fd240746ebef01cd378b4ffea19cdf139d44960caf41f88dce4bbab8faceb7d7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample fd240746ebef… — Score 88/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fd240746ebef…. Malware family: Win/malicious_confidence_90%. Threat score 88/100. 5/25 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L47","11",{}]]