26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 98f4c865369c… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample 98f4c865369c…. Malware family: Win/malicious_confidence_70%. Threat score 86/100. 2/27 AV engines flagged this file. 7 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff"],"about":{"@type":"SoftwareApplication","name":"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T432,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp")28:T590,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp, 00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp, 00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp")29:T7ce8,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerslevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method span.base()=bad flushGen , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext f" (Indicator: "CertOpenStore"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "ile busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CertCloseStore"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "ile busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CryptGenRandom"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitwait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedbad kind in runfinqmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handl" (Indicator: "CertOpenSystemStoreW"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handl" (Indicator: "CryptAcquireContextW"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanchan receive (synctest)makechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; s" (Indicator: "CertGetCertificateChain"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "wept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowunexpected syncgroup setdouble traceGCSweepStartb" (Indicator: "CertFreeCertificateChain"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative" (Indicator: "CertFreeCertificateContext"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin"), Found api reference "nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorychannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unex" (Indicator: "CertCreateCertificateContext"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin"), Found api reference "type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usab" (Indicator: "CertAddCertificateContextToStore"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usab" (Indicator: "CertVerifyCertificateChainPolicy"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerslevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method span.base()=bad flushGen not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext" (Indicator: "CertOpenStore"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file hand" (Indicator: "CertOpenSystemStoreW"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file hand" (Indicator: "CryptAcquireContextW"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanchan receive (synctest)makechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep;" (Indicator: "CertGetCertificateChain"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "wept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowunexpected syncgroup setdouble traceGCSweepStart" (Indicator: "CertFreeCertificateChain"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negativ" (Indicator: "CertFreeCertificateContext"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep une" (Indicator: "CertCreateCertificateContext"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin"), Found api reference "type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usa" (Indicator: "CertAddCertificateContextToStore"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found api reference "type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usa" (Indicator: "CertVerifyCertificateChainPolicy"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin"), Found api reference "runtime: sp=abi mismatchwrong timerslevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method span.base()=bad flushGen not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}" (Indicator: "CertOpenStore"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found api reference ", locked to threadruntime.semacreateruntime.semawakeupbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitwait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedbad kind in runfinqmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found api reference "exit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp")2a:T5f3c,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: morkaj.bet:8768" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: morkaj.bet:8768" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: morkaj.bet:8768" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: morkaj.bet:8768" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: morkaj.bet:8768" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: morkaj.bet:8768" Contains base64 string in header "8768" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: morkaj.bet:8768" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: morkaj.bet:8768" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: morkaj.bet:8768" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: morkaj.bet:8768" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: morkaj.bet:8768" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: morkaj.bet:8768" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: morkaj.bet:8768" Contains base64 string in header "8768" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: morkaj.bet:8768" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: morkaj.bet:8768" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: morkaj.bet:8768" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: morkaj.bet:8768" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: morkaj.bet:8768" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: morkaj.bet:8768" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: morkaj.bet:8768" Contains base64 string in header "8768" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: morkaj.bet:8768" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=96Nk3ZP4XuL9k4LuUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 911Host: morkaj.bet:8768" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=96Nk3ZP4XuL9k4LuUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 911Host: morkaj.bet:8768" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=96Nk3ZP4XuL9k4LuUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 911Host: morkaj.bet:8768" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=96Nk3ZP4XuL9k4LuUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 911Host: morkaj.bet:8768" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=96Nk3ZP4XuL9k4LuUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 911Host: morkaj.bet:8768" Contains base64 string in header "96Nk3ZP4XuL9k4LuUser" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=96Nk3ZP4XuL9k4LuUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 911Host: morkaj.bet:8768" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=96Nk3ZP4XuL9k4LuUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 911Host: morkaj.bet:8768" Contains base64 string in header "8768" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=96Nk3ZP4XuL9k4LuUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 911Host: morkaj.bet:8768" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: morkaj.bet:8768" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: morkaj.bet:8768" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: morkaj.bet:8768" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: morkaj.bet:8768" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: morkaj.bet:8768" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: morkaj.bet:8768" Contains base64 string in header "8768" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: morkaj.bet:8768" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: morkaj.bet:8768" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: morkaj.bet:8768" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: morkaj.bet:8768" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: morkaj.bet:8768" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: morkaj.bet:8768" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: morkaj.bet:8768" Contains base64 string in header "8768" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: morkaj.bet:8768" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: morkaj.bet:8768" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: morkaj.bet:8768" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: morkaj.bet:8768" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: morkaj.bet:8768" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: morkaj.bet:8768" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: morkaj.bet:8768" Contains base64 string in header "8768" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: morkaj.bet:8768" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: morkaj.bet:8768" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: morkaj.bet:8768" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: morkaj.bet:8768" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: morkaj.bet:8768" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: morkaj.bet:8768" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: morkaj.bet:8768" Contains base64 string in header "8768" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: morkaj.bet:8768" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: morkaj.bet:8768" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: morkaj.bet:8768" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: morkaj.bet:8768" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: morkaj.bet:8768" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: morkaj.bet:8768" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: morkaj.bet:8768" Contains base64 string in header "8768" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: morkaj.bet:8768" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=NiqRL0wsq6J8VaUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790567Host: morkaj.bet:8768" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=NiqRL0wsq6J8VaUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790567Host: morkaj.bet:8768" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=NiqRL0wsq6J8VaUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790567Host: morkaj.bet:8768" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=NiqRL0wsq6J8VaUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790567Host: morkaj.bet:8768" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=NiqRL0wsq6J8VaUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790567Host: morkaj.bet:8768" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=NiqRL0wsq6J8VaUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790567Host: morkaj.bet:8768" Contains base64 string in header "8768" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=NiqRL0wsq6J8VaUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790567Host: morkaj.bet:8768"2b:T692,Found XOR loop in file "sample.bin" at offset 73936; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 473470; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 623004; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 623342; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 672674; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 683990; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 701306; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 701837; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1362685; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1644660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1308686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1919218; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 156342; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 195783; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 303710; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 348504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 374501; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 375197; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 375838; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 642076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 986560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1569158; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1899612; code bytes = 80302c:T9f2,"ýwuÕG<·v]4ÚGúýt8¯97Éb}»vÛËÐóûüäãL=³I³øRï\J×¤)):Q¾¾\T-Çaß4²RKùá7yüf%ýâ:ÿa¤º--96Nk3ZP4XuL9k4Lu--"; File: "PCAP"), Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=NiqRL0wsq6J8VaUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790567Host: morkaj.bet:8768--NiqRL0wsq6J8VaContent-Disposition: form-data; name="access_token"c74b2d52-3815-413a-a778-dd1a84b6a2a3--NiqRL0wsq6J8VaContent-Disposition: form-data; name="type"0--NiqRL0wsq6J8VaContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamGÓ(Ô!ã¦ÿ=¾'oÜöv"±oq¢ÚRØ]§H)99PÊB¼Âl?1ì!l·GÏTÛÀ¡gDS'§n¶)Iq»f¿ûBEã¸äò=[09kF?üXõõñèÁ.äi)Ðsåî[Ly!Ñ\¡ÁsºyÏB¯BQx/¡¡|§çWT°ê0â&=]´ïÓ ==æF÷ é7Ð÷îû B{M4%¹bMùÔI\ÈEYE¾bÅî³\rÑäliÚuvÉyeq4}n&¿ÕÑC¬¼â÷È{íÙ];2=y»"WÉÄ#í0µÄ&Ë¬,Ñ6uÑHø!4µCóW1hMåã§özTÎ£tø¶~¾¿ÑòÐÃÂH«0óÑ0ëâ0ñHÒ6+£)ÂUÜ«k$»RÀ~éúÊùý¤úh@ëQ;¦l¯^}º*ìY=b¡øg³·wlCÿ)2rLÖ±¬;»*+É>¯4éôêö£1hÃÈ%ÂdäEYpÔú8óÛÑ¼îÁøÞ°9ü»F4Ò¬ljújæÝ¿r¢ûþJê°F½s:®ô"OôZÆÒbÄ8ãÏ@ûüÔáÁµÙRtµ×ªÛ/af£>¶übèê)ìäÑùKáÕH3äB¸=ÞÏ ¹ÍZqéøSåU=L*¸p HªbÒóÂ3ù0+¨Y'êR«ù$;ÐÊ1z&ân><ÿàËßBÝZ|Ï>ýGrÜ`áì3^ÒwÂ9QÆ +*'éNû%æÝÝ%'ä3Áù:)]Èd²XqO)m~jfu ú«ªXq0[m'FlnÑ¬½l¿1b+aÑ>^oú¨NÖ+ïM«Lêû"¶F~jzáP¥> 3uA´Nþ7k\f,øpô¾½rý¶ÿó·µîeÂÖP6pn6êJMYOl4|Ü+¬ÒxîîPÎYGò¤&&)Ûº¼NCå<*O´Ú>²!A¿³ÞHä\FVý=_xÝÏ¾ljæû£v ëynË»çKÒð¡|Ý}ÿöNOÃªÌæÐ}½3?YóuZïïaçYßfr%gÝ¶FÞµÁçÜcÜ¥Júøú$¯Ãîiª»R1ÀIÙ¢]y°@÷à9l/;)t³z3úè&Ü±:]zeÄáQÂºLq¿?6%OR8ØÃ²ÓPZÒ¦"Í&¾Ì!P«3°ï)®ÿPº¯¸zjz\í!¦\p@óv"º3Sú:.Å»×`Á"¥ ákòvÂË¨ÎmäùP*íK¥ØáãËG¶ø¶IòêÖÏk/q×âDãì'Ñc¯shÇÈÅ)ü¸¸;¾jÈO-g9*ÍíÞBpþiÄUã¾z¹í[4dM§oìEm¨Ç3{Y(:IÄ°µSæ*tÍh9Ìc¬¾üBÁÕÏë¦T$Uäç$Q}¶½*Jú¡yó ~õ|²ÿ^kX;÷~£(j¬ZOÔ Ý¤T°áÝfý^¥bDbú}ö20^·g¿u¾l81]2o¸h÷83±^)¡ã¿ø>êTp=wòqESíøJ¡D1Xd«îØ_ëÓ6C³d¨Â2.A-îSò)!ö#¥Ê8ÙWw¬E8¸Îï¬¶Îëè±äâÿ2#ÀÝs»=ô·^Í¬È&~£õt¢@%¥K¯[æê)ÔèuK2æûë;K¢·[¯È[Â£)¿¸rÄÍHÄÚp ¤6Øp¼£!1PõQ7!à4UÇþèîÔ¤7ë:vÒðbc»t ùÆKTx´ðÐÊl®/§E-ÚÜuHtà%éÌK_I>ÁT"ðTðÉo¶þ"éÞAu[3ñH|Þ}þ¶ZAQh®¶F±ún³R¯'±ñ¢l ·Yà¢iÓú¡ûcG°º!|«=;sÛøïáêõ-Õº|æ3·Üjd§i+Þi4ëÍ?¹¶ÝßcC$&-òlÉÿsXi\$ó÷r5t»dpÌå TtýöÝóí;^+%5Ï-KUº°$oeJl3§xEeàíêÁÒImPoÜîèäbGMK/}d}£ÙÜ¾®½=¿>vw@QVÄLUÿÐo{sîiî3XËï3i->½üÒÃgýt ÈÅ^ÑVFýÃêOF©FdCw`d¹ã¸-/îFkó®0²I×$à ÉU|Ð³z¡´ùQ÷\È0v²ÙÜThï¤Ú»åaÂnJÓ<"Ì¨ <~Íjün$wkSlQÑ³YL{5àÈÁîªz~NE+h<1aú&ÏTZÚdÅ&ÏØ®ó=q×S)ÚKEæAQP\«(Ur!£ù#ZúAøÖÂÛ±[kìÖ×87õÄk4b¥tÿu«M?f£5qSTÙfi@e)ª-±ÅØR7^g·Sj3ÛS0ÑÃxíÄÅÝÌëó±!Ü"®rC#^ÁÕkõYáh±úT#ñó§oqªó±Í@é¿L@ðet²Þë¶!¸ìy26?uðCòëÈ#G&`Ð6þcYI|dch%KW/ïWª¥Õ-6YòÕYs4òÚ×BIe©Æ[Á?6LÌÃá¶Ö4Ú ÏÝfÖÔZJêv "MÖ:õ¸`+»¿©âSuKJ'5mÿáFUÛÎ!ä·Oog°òëgoÏbÆ)xà§hW$b0¼pD/îXúâ2?ó{eìðÒ÷°¶7u¡ç2?¬s±ü&ó¡©øZsÑÃN·õ 6¡ß¼>ëÃpQÓa³íËÞèz]è)£j[¡XªÑÀ)ÆÆt]*ÚgcPëV0ÝË2cm¸SD¡{rÐ/áíALó'±ò¯ì#Z]bÉÃ¼3<ëi Ñèí*;Z:ê v¼Mí½Èä²~H$Ê¡W¦ãG?rÝä©ð>ù.b$êÌªbz¬qëtSxáèSTÏ÷fù'Ñòï*á³±½ò*ÊZ¨±ïü¦£íÕ}Ch7ÓÆ*BÆ%ëLþ+$uQìnáa]ÊhÝØÅÓ«ûÌÑÈ¶Ón´óèwQÑ´§ÎÁLõì¯_ºªã ¯¾Ù±hûQD°yìf±Ú¸ï·è°ð½êÙFÆ|¼ÈrÚïQ÷YOO§*é#_FZTx§íT!gÛêY.èM£¾6½ß#_ÎÕw,¶9fj7©î^tÓ²ÌµG¿,QÃßZkk¨Øa¶|ÂP¼=kªebÁçLúGmªûs·93úüÝÏ¡Kë}Ce6µrÓà xã©µYÃÖÈÁÉÒPjõc¼ËQc¸9OÒôÓ®Ñ¾5%!ÃxïN:·°m³MON£Í×ÂßçËlöë¿4g¥:æìù5"kìMýÀ¾mÌ( ÍRçælTi¸ÁñÈÐUá¥>*f#Üýõûko-f.UÀ¦ÿê4ï/²·®ýÀ!Ö/¨{¤ÿzoù@ÒmÎ¥é÷³øå¦%âv{cBwßjÆP !ËiL§Y9G{XßBÙR°âKE]àÜp1ïð É@O{ã2.Fß ká¤]%hf¥f²ÌK×«;äèþFd¸G¿Z3Ú,¨{|óÝ[ë|}Î +ÐÌ§»óÛGËzgH@E£[ô!òãc"%À§{§Ïò'ÖWÞùáøÊu_@UEÚ\Ç·+Éìéµ\ÙÂµG;Èÿ°mu²ß-hß'U!*ÄiJíïÀ ÜJ´LÊà£½¯©^8àËá<¥eÿ¢Ùëµí¡wt<;¼¬Ý¯Bw° Ð)Z£î/¨çâû¹B7ÈQ¦åDft<¸hòßÖv~ÁN6HóÕiôæ4D@ø§ÚJçâÔ#>î»(n¸P©As{áäÃSv:X#ÃâÀ=Ì,ÜïsÖê_?Õ³ÈtzI+Òpk¯ ;Þøííèî±{ãkc^T$@¡°>\½Ø(vlû¤¥õÍ«%"^6ì{O#î×R{õQvíéÒæù¨{ÛE{ç+÷yõ·ôY²¡*¿FlÅ3'÷¶½¹S¡:¼:_[äÁt¯LzæQÂksq-ÚbåÙ¸£¨²üI[Iåð d³c«ßsõÔkcv0§Ô¤ÉsêK0Ññ)òM_-!mÕ6Á1wËBWÒé«z("£1>1³©£{x6e]¡½æÊ7.M¿ñ+XX÷éxüº!k9S·¯5Ô¢vð¸ÊØÃ:ê½!X0HÓNàJº¢¥¶<³³@0ÆÍ{îpÑÛ²«ÂÊ1aÇÚ²ç·QÒ÷,óCGÌa=/ Ø¿ý¦¡Ó÷udmj+[cíJ$mrH±ÆDvDèëÞ\`?,.ÿOúôi¨Þ>%Zî÷çLÐïÀWJ*Y¦d*¬ð}"²Óhù4ÂZÐ»¦ÊÕD³È/ðgÕÏñ¸©*öP·Xß{t×GpäH¶Ì>:Cv¸õ·ë[-ú¨ZÌT¥nîL?A/½=ÖïåìQD*]BÀÙDáø¯+ZOgÄ|mp 2V,ÀÝh2Af<[Èº3Õñ8Ê¼k)Æúõ0E¢È¹CÝCôñÙí®Px¨ïÑûÛw¢¤·glB-Y)ò¼ßéVóI/ÛûkGØ0ôUÎµ~2þ_`ï+KÐ÷ªÌMc®ù»pîÿLv²\ÀKZSAÿ,R?¼b¥ÑþÒk\fúÌ*¨®,iÎD·½Å"JÅâãAá9¬ò.LÔüá²Éª¾Õ}2Åw¢pÊ7ÁÌ÷ê¦6Û:$*=ßrf¥xÀ[s+,YåÔLPÉh#w9'#Iá$uàJøj¬@7I®CTQ7£÷8¢DÒß9nqwMæøå¤~ªkl·ßYÀjGGÎ\°¬W`ª5èÞ r«ñ$(óÌg§¡?þðHæÊÎWy&Ó;üO¸R·Ø2ûîéElÀ£½%ú0_P]_øUµû\Íë¡I/ã_ûVÿËhï3<^{£µ[J 6çòù®È©ý(û«zô7]R{ýíktwïfÎº¥òÂå¢b¿-¯bÙµ3¥,àgÐÄªun,j&úøç¤å2´ ãÓ¯DÍu3ñR ®R%x¿©¬vØ¨ZNàyâ9#Én-Y@gÍ´DQ:AâÄú µ«cÕiEM.ëÔ?@âe3Hü½ð¨ílK QÈßþ6>Ðÿ¬xxÂÌ;VÈv+ßôÕ=,)`.ü¤VcËÃ©9oé<øÆF:?ÑlÁTðôEê£±ÖtEaÚ*18Ëz¤ÕdxEú»G;þÒ@§ZÊâEþo&BY²¨ð>´¶ï#ÿIq9³º~SúÏdhvcÿãÍ®SÏ>«Úë©ÐSÁ´mBq¿NíÞ6«øM¸Yö¸¨u%qEøK¦^Ñûx8Ì!ÂÎmÿ+ÏV°ºzOïãÑmíf}/ÄM-Ãýç·E%QB:#<£Ð5Vg7«q]9©È$n´¤Ôý¬µcö`âÂO#¼ÀØÄ:Ë¦¦09\üËÚ#]f%kÕÓF½àjñûé&¹Ô6ÿzÀ`É¸6ËQLÙ½?WuìÌU ×Á×ÿ²+"ß0öºSãâB!G½õKkØêÈÃW©PcÐàÊ@Ñu#~Z®êw)©b±øÿÖ{ âùæòûr-ÞjZÒ@ÑW¢«æ.ªîð¸Rp ±_4L¼KG¶Nçî¿ÃÛØ ¤âìý×õmó~iVm³»ÇfÙßÒRb½ëoÄØF·mLÇ¹üõ¡æ¼üµVßº±9`øæ7!ÕLÔpZöÓÓ]ð©»bZ.RúÊ*ó*Z3uíÆ|9¨)[ºndg§¾AwÕ'XÞZhlJ¥Xª«;Oª^o´Õ5m=iÿ°ºùP÷Ëd5j2.T&®¨êûgªHó!rhzî¶ü¢c¤È¥¸ê_æ«äþª*8¼ÅP©ô;ÏYVâM28Z¹híQC({øQx#âMéá#ãx¬^:upi:ËOSÝÂÝçnÚ/`*]V0(ßÃp9¦=¬vÀÒUT-!OXc/ö`ìÊÖ î<¡Ä0W@?#¼B>ùëìÇå;\McöW¤Â)çS FÖfÓÁù(©?ÿØ6ü¯#fjxJµMòéAÆPdt?«*¦æ¡Õ¼uÒexÉOKF¶]|Â-È3ÆV]ÏU4²r¬Th&8?µLý¦h9;DAg*Li_óìæA7Ãé1ÒÕÃ(<)zyµ¥;U¼¡tÒÏkÃvb-[mÊ¦sñ³)7¡ÌD&KÖùìTýqÿR(Úi0~¥]6ÁWÌD·¼¿Â`ùMÞYù\ÃCD¿À<0ó*uåêg·öÑÓWò}¢'ï¸qù `¿~Võwât$@Ç©¥ûõµÅ[SlOh¯síZâ{¸á7ñ96 q&DïÑÍÕ#°,Cc¹ÕY ?Ã÷p×ò5»±|Ú6b`ø½ ó8F4"² îÒ"ÑRugWùÎâ;ÐLñJ0Þ3÷Ö3¯uÏuy©X²n>´Á}áØ|ªþ¿\ÊxCÊ{Å6ÛÜ//Ó+ûå+8"*@ÖJcÀ¨æ-ó>´PôQ'ªÇK»|ÊäKsJïðÐSÿ\þÆyA~ú÷ÅÛCeózrV#mÄ9î´/:öRÁSÎöÂ$îp×WCÞ6M²»Þ6&ðÛ:î%kKRû¸®m+«·²ÀL(:¨Uj|½s¯#éá[÷][8AÃH+g±×¦WÉ4UZè-FfÆÉøv$lbÞúÝÔK R"UÖÆÄ±íÓÞu;Qû~òêÊ9~±¸Òß'Ã-7>¹ >$ö¶Hzò-¥¥*dÈSï£{{7nÎ÷+´jGIº¤Ú½×É®0ÅÛT©}¥7[P!9%ñ¨.âG¼g_Á4'8NÊLý\¬ungÔMc-ÐaÈL²AqJU%-Í'K8¤ÏJ/¤ÇùT@ØjBçhØþÐÃqrÚµWg(¶AìW@l%ó-«¡äpÉ\vïhr<²\)Y+"ÿ¡H}@ñ)m§è_×¨¶ fäéBÑúJ3ÉÓ'¤&ÚE¢XÓi¾)»'·É[*Ñl¢§o^|°¡PhÍXs}3'\Ð_,(áIìªÿújÙ¤ëWýZÃ&»vQ%ã¼þeÇÿµe}×*:µÑ1I6Ãv³c<¨Ü Æm[±(§¡Ís~ËÜ©Yk,A²ãbøBÖ5µ&Ãb-k_®êÔ~ÃÁÚ1¦8¸éÐ_Z¥¸ôåä]! nÎ·1ÃmëÛMs¤ÄD8)Á#¤ÓÛ&»(K¢JèÖAlÿ^¿sùÝálêìláö:þíüâö,3Èr¨àñ³2ÙoÎ½GSrØz±üi×zÖÙÝXÐâH¤ûõÚr9Õó¡/¿ÈÜ ÁqÚó+Í-.¦^Xâ{Èäºï!f@ª9 4Js j9¨9vå®Àîü]®@¢ç$íÙø¨x¥g/ÃhØGÏôwARíÍÂ;Ô!w!öfòÙÊñö³KDd?m!íå^eñþÜ±<¸)Ðh,tÝnÄ*SóÑ9ç)ÊJONétÉÀÆ¨I\!$ò¢Ç»ÇUP?âYaç4°¼*A|vláüú° rq±¢¿sá¨Á<Þ6"ë?çôÊIÖ¢Ûþñæ¸[Ñw|$3°L¢k+×¨¸kìAæaýÑ[öX¦|òä.`ØXëoÿí5Ì.SÇÌ7Óâ6ÏXvì+ª`ÆÏ¦Á¼ GñÕ%Ào@ä¥ÇÞÂlh:¦/Á§ïü¸ØÕCMÆ&øÁ¢ä-§gðêËoï~Ä£f¡¸L¬}v5è¥Ü'½>çÆNÚ~ë¡:7|7#ÄDÝ,ÖÀGAXs·Ê3:î¤}D¨X2]Ù ´{~H#,Ê°ÁÔßðm^MpükïM;ïó9¥&ÚÃ®ÕLéC¼pä±¢!n°®ïéej{qÌÞ'g_0°Ím1m²Ù}1R¶v¥Vó@±µJQ#ðð}¤êá³ÀÐ¦mÙGFb^eÂo²ÊÊúu¥9ò*ÇB}ÉdÌAúkÚ¤Cm³(DÚP£nÖXÓNqù*bPÒÝpÐªâÌ,e"²Ø×8bõÖ@1ûÐ:uÆqã}Ð¨ÝÐsÉ&t+5¼2ê¹4pàÜcéCÎXÅ#ÙE0õÁxteÇzê6æþò"!=Æ*0H,6QPvÎ¬ç<ÚÂr^ï¥!?ëez¡©9HgÕ$Ávû`¢9W8ó,ùv:á¶ye÷5©ó¡OôDîîÞQ)q|4úYóbÃ¾eµná¸¯5ec_ødëPE¯XýX¯ÔÒÝ÷«t¸FéPþÏêQ^2î!±%NÞ¢úpöÜò|ôþõ~Ë¹Ú0ÓØ ÞÃÙ¿k¶ ^6èSÅ;ÈU4_»:ß6Dº§Ë7ø ^#5=Ñ8¹î~v²¼Âk®UEknÝMomÒU¨ÏTCÑ %æ·íÔë0"ßºvw¬Á´Éói.W°PÍöQÁ;X3ß(T¾³Á¯¬½¾Hi£´I(Ü;ué]¹1gïì¹þq·-@³Osm±ßlçô7ëìLpËû/áªÊsñÜI5}¶;{n)ÄïÛÕ3ß"^¿½< mÀ7²´*ÑP¢²Ï]ÉïßHR¯w$FSÎ²N[·r:oÞbi«1hÉÜM=°÷¾FÜTQíaýW»{bfíå6ÑSúOhp(õ\¾Âìq{]O¤Î¥±RäÀ©w_éÎa¯|¬tîÈUëÎW(Åu_oP5cü´aÙÀmC¸¾/lùI©dê-ôÝGRv'²H\6çëàëÇmÔë¸>øÄu?P`{®zÏ}¢¦§_Ý.k&WRQm_}`°pÄûoXCQs'Û¥Ó{ñÑ"³2D^«ÄTyxPJèÈÍ§vÂ ½[Út¬³üÝRwdñw¥"è[äcT¨qH½å&Oì<¤3H+&½Ë²Õ%$@g õE4`ÆEAýê¨ÕMRoð°qâkñdCÔ£å`USEÈv÷åk½°`JïBôEøõÁ/ìûðë·ÝO/ëÔgµ,ÿKR¦gVo?0<¯mæ¥£¦h|æÓ»wÞ~B f±ÍãJW2"£Lì±<Í.Î%~ÞE Ó^¶+ÂGÉ<çÛÈòo¨¹â,*ExÜæiàRïs6Új"¢8&×u¢²YX´E4äN!ü"%ëhtçóZ}ÝnóU£ýÈLÒÐÀËÖ2Ñ¢CI;:NóëPÎ^û`ø6´ÙkD?äÁí%ÕHáÔu7`²·ýî¼6$[HÌÓ"$!ÒI-?léÇáºXõAXãTo®'äÂåý5Å¶7úû;¥pîÛ×¿<~Úò'Ujq%dí(3×É2ðÎûíªõõêD4XûK{¿ºÈ»¨àÎïP:Lu¦¦Ùz¾É!I[ì¢È$PÐVì«Cý `µ ãÿ©'µ?í³Éw3³Ù½µB5Ið¿|¹ÄS>òI¨ÏÓVßö}áh\·§w(-èZò©¹rFt}ÓÚÅÁ¶%Ê:ãÃ'ÄÞ¬~_" þ_(Ó¡ÀTÊÎëÊñ%ÚÖÇ5|®¥4'úÁ½®ÓlOÙúÞÀûX§©VØD\Ø£Vt:ek]ø.ðñBÜ·ä¨o\+Â2·"Ó¡²±[Û°.ýz$O¹í¶¸à3ÊWèï6^\MÎä³DÌÚÈ¤®gLÀ]fsàÚ¾ec¤µc#ï>á¨Ú+±G>f¸pkØÙYÆ^îÂQ3 'aðËÝ6vÆÜH ÓRToYóUÿÎPð# wx*]³¾/å¶°ÅÊkVbZºíÙâÿþ@øö°áÝ`!c )À.aa¤`sI¾ä`3ýÈ97÷ø&wwo¬ÜØô®àìsÌ1¨dEÐ+Á¹¼>· TO^¿eãS«jãj3ÇJi¤.÷G;>½MCáàòëÝ@E GÑ¾{³ò¶ZVÁæ±ígúwéåíªèàÒì³/OkÏN@e?3¹Î¨jÐÚXHËKJ&Ò4\îüë®i<µûÊÛÛé5×Iïuïâ½®0:³j¡ }Ù÷:þuüïFoý°À&XÏpâÐjîµ×Dþ9ØaÏbøv]bÉý°Ýaq)3Ê3-IùgÃ[FÔ¥DÀ²¢ERe´ý°²!¦etåêå/½àôâÝ¸ÀTDB7zdÒÓ;Ó"~·DÄTz½R*C«2ÖäÖ'q@MDÜÆTíA>ÂHÕi7^à^§V!p¿wY-\ïÊ|EbÓºæô&ö?Õô£$Wµ&^n Jü!uIÎHTRÀDï7@ÑÊü<Êÿ=o¯£fTk5¬¸ëaë½j-æ)ãÌ£zÖ¬ßédv+jÂRãèËÃµXN[X ¹mùaN¡Î\ ù¤ñ½ZÖ¬R§iïÂYèxùD<³sSçf½ øF"´`ôWçK2Þ¡'á¹Þå¢³æ |bJfÄµ%;\Hð°7×u^^þ³É³;PA¨µä\p}~$Ø>s²nè^VÁàëCºïË¾¯äæ1©æ7¤åàÔôÈ®u,èsð©$I¶uFOÛHvh(Ll: }³].mÞ±¸óX¡¨òØ}¹Û<÷óÚÅ«ù@ä{èP[)R²e,ÎS!î÷/36 pó°^vºé÷A3±þ\Èq4ôÄe!fSÍjrzG²°qHHÃ×5@gHkt¹Ë¨tÁâæµBOMÁt*h2ýÈA¡Ø¯÷rQSÈ¶±Ó¿¢î¬;qv!Bÿ´"ä¸q«-èþ8¢EQAÊþ,NÚ7ÌûðhWdæ¼`JòÎk¤ðO BáOöÏ·ù<ß»ñÃÛ`wèsÛ%B óï5»ç®æ\f8ÅfjÎfÐ yÇKÇúbQ×YúÒúîÝI/î©BÍ³±_(Î`°91QÏjD d\Ô6j¿W*¬ wÀn76áRd¨n©@wmÎà]ÎèE;OÎæP¤áÅ÷JD×ç²Fx^órÉLyÆ4l~Ä(;´ÙÍÕ@(%q,9¤¢I©£2"Äc±±íªå`~X#ºA½ùUÔd¸Nw¬8ÂGÖØG"êiU±îÌ:´Õ,~Ë"3CßT1déGlW=}EèñÉCá~÷Óör¿¿Ç¹Ô3RS?LíLcW´Ãhßx¾A·R@Í6É4L®¸xò_hªgç4àÐÍ(J,ý{>eqQ?¼{ÀóJ_Y[äÎß1>¥ù6÷ah¤öý(zÉlpYö5n9®Xú½ !cl+h|4äì;4¶¥&$²#yÖÐ¤N·Î,e¤Î&sºöÎÝÄÒw`éÔX=yeN¿¥[ÀÐµoÈ¡¤þ&¨ ¶ÊPýÑíd ò/Ö7`rS3°§²;ãÞÐtPÁZÝû×DNi¦IBÍÚòÎÍ¾[s ÛÐO¥<·Ã»}zJv×.h{%ÅÔ:Ä?<2_+âoÁykÄÚmDýµ ÊJ1Ï#N75Mx`y7âý¤^ºÜB»´*Ç3h«[û>$ÇÆ0³¾åÔºó¶®kàgq÷Pü7¯ jéÙþ·ètvpF&QJíY»Ç÷n&Vý×8ÍñJ¼å²éùS8ÿ5Iü=É-!µõi²â.q(Bã1Â²Níq!tÀV¢<Ô8¬{j_Urâ_Ûñl-á¨OráÉø¤ªExÖæÝç=ÅßZàQ9)[¥ÞÀx.5øûQÜB¡"YÊ"ÅQþD¥ÌßÆNnvËé¶:Ú×°«Á,èsv³>ê;}iX§½¥+Éi8OàaÛÊ ÿ"fæ»ß¼¦¦W µ|»ØÑ:öqæDzT7à*tî ]Ro^C«TDcÎ1ÀB²V¦Ç®[NÇ¨å7[`FO"ð«ë¤iÚM¨9s_äwT}2²NvÙ#¥ £=©B³s¨<èÔ~ØÑ=ÙêÝÓÀÀHòÒ'Î2]£.°Wp¦¾70`»aÆk}DÆ0ÖSíNyÉ¹Å[I;ÑzÁ3Ëñ$*>Ýáì½:ªÉühÀ>l¨¶ßÏù£gÄ çKÑÙ8®¶½ÃÓÿª§Ñ XDgï»YåÃ|«¼zÊæ76AÀ·l`(¦L=j7¢tøfn>T5÷cééõh AàÄ6åÊÂVä"gçé'æ#´á2kïñïêf@AÐéïe±÷>F$©0¾éE!_ôüAÖÝØÓ¯Hßa½e1Û¬é´¹¤,f¸ùmÞÇÂæ)Å«ù"!ÚPkÇÛ¢,,C¸»çÓa e$j\EôÉIÿFNbY%,Õ¬ÞÎàÖ&¶}úÛf¢¤¥=Ôx:Q·?ÔeFwü_±>i_~k$³Ö=HÅ¬À(íàòÉÓ)jâoªÎqêC%rèÏûóS@øûe,¯+ØÞt m0¬©6Çê©õg"æùÿÓ^ßûHVa§ðae½÷YºÃà3í|¥Ä7oÊ>YæÝ.e£52CÏJc¤a6òÎl9óçâ7¤6æóPäøàq4mà´»I|Ï>ÙØÄÛ+~àz¤¦ßK¿ò={P^XVàTÀßKù$%cýÊâBÇ§÷Ã¡e-K±TÃ?U;Í!çÐ\±)ÅãÍý-«B.yGWèv+¸£=ß¥±Ðaä/B×-n§c·É-ôÉÒo×Ã×Ð\ ;¹Ô°h+¼Ç-¶^X²o»»oðâ=eY²ÛMÛ¦Ä` Äa9}Z¸È5;ªvWñ¦_ýÌC)Ì¿¹)NRÃBH.7ÙÚ{µ*Nµ H:ÞÎ$2´ø¹¼$tZM-õ¤ÚÖ9ýÆÝAëQ-oñ"Âm®ëÍ5Ð_0Fúj%©ÙæK6+ò62ÃÞÆØÜ90éSµdc»mlÃ¦®±æTatn÷¦[ÂU_ÇÂüP×«P0gîÛI'íu~d¡ö=MÚGFdª¦!Ì¢¬ø5ªzwQAp6Ú¡¡eÐ¸Nü²wª£^§Ýê¡/©o \HÔ©Î¿c³º4Æ£cfQÚ§Ë§ ZÐàñÉø è«ÔÿÓZûïc0³|/ÒznZÇ¹é[ü=çL4_éãpqLiøIx3TsGÏü´æ-â}í×Äè?KkÕÕ/D8:mýÀ±+L#Á~ÊàÖéå(?@ïe¾¯9K¡¿*eÔ]þªò9ÍFÐ,Uýt°k?¨TYé®óðÎo¾r6¿ïÛ,÷kíl'Ñòí'M°°ªå,×!_cÚ'´ýáÜd×ôt§ú:LBÜ7L,dÅûPÒÆÞvÆ!0éå1ôÕLe¹¸ÈØæ¢°ÁB_B×áð¹åKÊ¨Ùo¶nó]ý¶[r:_ ýèÀÇuèÚ&H²ÂÏâyÊ;âw¾Y\nyãj¨Ä:î)®U¬Â]ÕÄ\¾ú;¬Øà×ééM÷ÑM½V&0OÑÈ7²qñó²zõ| F!Tê²Þq|ÝZ¹¡Ø6õ<"=»0âÝp4wB§!áEËý^|6/°ljFwÅ4bB55ÀäOj·èXÑgoºTÈEÓuÅÏÁEür.ì<ÙtëAìòÉú/£tdð[+ÞÓ-åÇ.cO¹8ÀÿÄ¡8~¼ÛÃãû«Ý@ê"^Ý¥}Ý,ÙÄÌ§ÛÉOïEþËö?²öPqBÃÉuøn Û#)E&ÊN|¸8-×±êT'·pÂ31âðm¸RlÖaD¯ ¯7cî ë¸Ø!oq^Ü×z_ç(*~ÍmÉ@¢æ;w¢<ËSô¼îQÜWÇ<2 #*Xº4}¶êÑEOÊeÄÅæ&ÙÛepÑUÆ¾°±¬Â õo¤+gçÍà"zJ1ÅPºM×l%¥LÅÄ,(¥ó(©`7g°Õ3 îÌZ^[à_6`p¹¹sQÑ{N£=Ië. <,¥¢þ.¸möò«îõ«¾/Ñ"Qq4KÊ eJº0°! ¶¥÷¾Ñ3¸Ï¦XÏõm{¼Ô¨q[ÃÙÉ&ÿf¤Gù^Í¦´W8ù3b*nH÷+¶ÒeÅmV7GYO.¸ë¯KS4ÏÕ·f½>¾^+''(D~-×ÏöáWµöþ$ø¿nuG /ð¯n§ØääãºúÜGðâ°`ÆV>ßp±tÂÇÉSÒYiiÈwò·Úëé©jXt´þké½ÙÁÙéarvqç]îK¸.iI½61eÖõPÂ5JjÌ!~2ÿ½]Lg PÎ]E&Å=¦j¡~Òµ²bïZf¢ñe}åáÉvùÙÛNÐ§òÎ¶)8¶RN¦ý]9eË(k~cÃ@rÂ¤2g\4öÖ¡åBéÓLÕh]dz²5 yYqÌ«æÑ»5K$Â0¯¦èÛÙ,¡òþ×Âæä4¬¯¾h/6:¿#¬æ:É¸þ^¼üevHOÃWò6ú4dã$6%ËfÖ)Ý/®ÿ#À4ØSKh¸-ÝÔ-®ÂyE2È2! 7:c«¼|aèlH>t<øH5àôxg'µËä,`M¿¾Ä$ü-HÅ#6Àd³ÄAsppR½»ÓàvËó2rðÙ|5]ëâú½95)8í ×çhò%Ó©?àÏ É,/@Ï¶¹¹5ã¯IQôÎ;>§MØð÷kc±'è8¡îóùq ®uÌs|¸Ä}²¢':AºW|ißÈt©|Õðà¼Õ±ÔYWµGì~K ÿ«6óÀÝÞç×8SGoBMõÜN$Ñ½û¿Ê¿°Tcíd¸VeÚÍ_Â ñµÅÑ<*ÑXò!>ý4¿±÷tÆÃ)w¡tpPëOæÌöT\1îw0g{>ý÷÷*ï_15óDB&'ø»°¤ÖPvÇOÏM²`"uÜL×ßÝ¢·dÒ8x³h<|shÿµWåá¢î¬ÐFÁíÍC!2÷KeSh/ÆûBtSeo4A§ûEÚ=!UÝZ.eQ0º&/ÍÂÆvÚQóìÖJøvXÆÍëjÌâö4ÇæS90mº)8ØöuswÚÓbmû03H©|ðK/yü]k0+o*ô1·J_½u»Ýz__§|èÈ#`Òù(àA´Éá«r°¤¾ã<2=j«üA0ÓaÜBúÊä aËào"¦xõPC¦ÎIÏmº ýù©±;²5OUL5·µÇFWPjÞñ?á¹ï¸bfØZÅ¹Ê»Ú5SâP7ýË]^.úÚtóözG0´Ú/ôX:;±F2±¶z&¨à°ð2|øÿ£\ç4ï2ò9¸¬_L¾0~ö¦iÆÆÞLU¶èÝæ\_.¤©'kàØ·cÕ'¼m¢åCàÌV ª¶×Õ¦|ÿ§jÂ»¡¬Ø¦:}A¹Àkbl{¯ûÔµo9S'UÖ=Ø9×ÿVØÃÌÂ¬<¹>JaÃa¸¡Ù¯p9õÚrÜ)R«¾Á@ÑLnÜÞnF1Â×±Ný%Ã?ÆÔÁîX«`÷À)Ýº08þ ã¹Õ_«¤m¤B 0(%¶U/J¶BW§¦yT*×íLmj[x|Â¶ ô?F»c1_(*sô[bI¢`o·:Zÿ´ÊÍÍT|Ì×B¨ê5àKYÔìæCe¸H|Å¹ÓSZLiE¶ÛÎ_c¢|êSïÿÜk4ì¸Ã:á^}5_tmû.øÍgê+hÜ:-="vJ´[°Þd®ZzÎ?qºÜRóØVz$ñ9t® ¯Ég*9ü½(ö\Ê¯öHC9N(Y¨yÔ&¦H8h½£.Z:µh¸AÁg²D¼åvÏÈÒÑOb¿@/#Êñ \MsÇÁ=±B;XE7x¢-ÃvÐµÅIl¯.pAÄþ·Íïón¨b¶Cn~¡×©.Êw@åõ¥gM:3±¼JT]ÀA[Ì¦ô~»7]%I(£=2«<éT)NzÓbT}oÕº¡õ>y¬E²?ñ"ÎÝHXRHï´s F¬3\8 ^ÐÙMà&¸Z{÷#ÿõp))&9ÓÈÆü.G9EÒ>C¦zHÌéQ¶_Ð#+Òn8]óÕºÅ]cÎó]e¡Þf[qÑ'å³ÈÀAtÍOH Çx¢ZI~¬·½ÜÕa6M ´s^Ø-¥:ÍÖKbböÌÃ]ÔApYÆÛg¶éÓö¬WºvÛW_'EïS´¥¿#Hat|dð o¦àZdãÂÖÕke·ßw)6¥hDø`ð1¨J<Åk©RzñkÛPH~¨pÅ+Þñµ©`RRûéps2nsÕR$~zàª±âê·ZµdvÖîmãÌ\ÇÍªð.eÇ¼ìáÃAè¦!æÊ¿ÚthÃÞ²ýEÓ±i$<ÙLsË»ïÌÁøÝºÆ×ß´)õ´0í¯,§L)dëÌ¿[rê|ãgôÉY±\®4óIß¶C[Éjµyg@¼X¥4¾&Pô°")h)ó¯tÉE±nµå"\·ÔþÑIç¡²5%$?ôà×u6Txèø|7Bªch¶d^TÅe»oû«Ë&ù%>7Íè¿Guµö+±õãÑÅ`Ö©.ô+}\X-#BC8ÊÃÓå|TÀöûÚ#üså[úyæëqªX9c{X÷ÌÜ<4³[Ï^e¯y4Â{ÃO8ævuGkÄ`ÎpÈÿ;3ûµ"ìÚùv/Ç¢õÎ4IÅï0ÉÚ¶'p¤ôÝ@*ª¡J¡HxÄXxäi1¨Ô8\:Ã²ÿÒ~}(Sþ¿ÈVþà»©®1Õyu0yûäEG«Ê¤BóRRR/áþS¬Ð£Ö{êM¼ÿ2àéGºÝ-¯R>}G9Ð7-Gøút@z Ñ¡ªÉýCP<à4Å¹Ä®$FÊØKË½o{PR¹Nú¦¼Ýß>·E\;/ Ãe~WÞhÀl&l;¯t¼Ro{ÐRoê?:²LÓÖ¥ä©yM8ö~´?µÎKEþ'ýÀýd!i»$RÇrÍiç¼~ÕñtéÁ0N±ôêM+q1¿Pëþ@¤¤]úÉ¥¯Ó¦IWnøÊtæ§Ô§ýEº^æÂB²|#»éôgÖæÊdÙ14WÙ¡5ÎÇ½l¼Ý#k-|×é3è3ÝêþwÀ#¾ò"+M?¸ÐëL¢pð¡|TÒHyóH7n,)ÝSÄÌPâ©Ûr{Ã¨ô§ÏnrÊ¥8(?uã½µãÆ>Øàì ÇCÔ}Ýß¨Pûf[DÈúZ9c-t"@OïXÿu8ÎÈßÀBµÂ{ÉÛ¢¥ûôRÖ/Á¦fPs¦»ÙÞC<ípÏo§R¤òV39Ø!KÓä(ZõjG3²&¼oéÒÎ×ë¯uOyÅò( §æçùåÀÁYSî¢Rx3þ½1:e- zX{&6ØÆ88*1?Õ°®\=£ió}nOæS)rÍÅ^ä%¾¼k»brëà_å(}áHîez,éØk9nýý§ÙÍþ,ôâëj£ÊN0biµHDEj\F¢P=ëç¹ôoðÛè~ÕåÿþxÄÿ¤ÇÜT¯,·yxdSÅ±«2£ôQCZö'¢ì8`Ú{÷á|Ä·R¬';ÚÅq¹KTB7¨äpÆó£BðÔ[Ö}°3Òòìa~ÜÕÄW¬3"*BQ:¬¡öíåðà£d§]Ö v6ðæ¼/¹&=µVA5H»>d¨«cÞ·úË_mÛ²}»J$§"; File: "PCAP") Found string "Content-Type: multipart/form-data; boundary=96Nk3ZP4XuL9k4Lu"; Source: "00000000-00001516-00000CCC-2041843939") Found string "--96Nk3ZP4XuL9k4LuContent-Disposition: form-data; name="access_token"c74b2d52-3815-413a-a778-dd1a84b6a2a3--96Nk3ZP4XuL9k4LuContent-Disposition: form-data; name="type"0--96Nk3ZP4XuL9k4LuContent-Disposition: form-data; name="file"; filename="da"; Source: "00000000-00001516-00000CCC-2041843939"), Found string "Content-Type: multipart/form-data; boundary=NiqRL0wsq6J8Va"; Source: "00000000-00001516-00000CCC-2113475868"), Found string "--NiqRL0wsq6J8VaContent-Disposition: form-data; name="access_token"c74b2d52-3815-413a-a778-dd1a84b6a2a3--NiqRL0wsq6J8VaContent-Disposition: form-data; name="type"0--NiqRL0wsq6J8VaContent-Disposition: form-data; name="file"; filename="data"C"; Source: "00000000-00001516-00000CCC-2113475868"), Found string "Content-Disposition: form-data; name="access_token""; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp 00000000-00001516.00000002.198840.00010000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="type""; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp 00000000-00001516.00000002.198840.00010000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="file"; filename="data""; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp 00000000-00001516.00000002.198840.00010000.00000004.mdmp"), Found string "Content-Type: multipart/form-data; boundary=NiqRL0wsq6J8Va"; Source: "00000000-00001516.00000002.198840.37DF0000.00000004.mdmp 00000000-00001516.00000003.199577.37E80000.00000004.mdmp")3c:T44c,file/memory contains long string with (Indicator: "wsastartup"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "wsacleanup"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "gethostbyname"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: " send "; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "wsastartup"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") file/memory contains long string with (Indicator: "wsacleanup"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") file/memory contains long string with (Indicator: "gethostbyname"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp")3d:T1427,Found URL "http://wwwkaj.bet:8768/morkaj.betdesktop-fvvf82a192.168.0.268.0.22001:0:14c9:dc0e:10b6:5d7d:bf83:f35ddesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:10b6:5d7d:bf83:f35db+ncalrpc:[ole07efd61c74132051e2db9c2da2a9]t" - Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp") Found URL "http://wwwkaj.bet:8768/morkaj.bet9ncalrpc:[epmapper,security=impersonation" - Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp") Found URL "http://morkaj.bet:8768/morkaj.bet??\c:\windows\system32\fwpuclnt.dll??\c:\windows\system32\mswsock.dll:\windows\system32\winnlsres.dll?\c:\w??\c:\windows\system32\wshqos.dll:\windows\system32\fwpuclnt.dll:\windows\system32\winnlsres.dll:\windows\system32\winnlsres.dll:\windows\system32\fwpuclnt.dll:\windows\system32\jsproxy.dll:\windows\system32\mswsock.dll:\windows\system32\jsproxy.dll:\windows\system32\wshqos.dll:\windows\system32\pku2u.dll:\windows\system32\jsproxy.dll:\windows\system32\wdigest.dllecurity=impersonation" - Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp") Found URL "http://morkaj.bet:8768/ttp://morkaj.bet:8768/tlm" - Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp") Found URL "http://morkaj.bet:8768/c:\windows\system32\ondemandconnroutehelper.dllhttp://morkaj.bet:8768/http://morkaj.bet:8768/http://morkaj.bet:8768/appdata=c:\users\hapubws\appdata\roaminghomedrive=c:691936,1200,0,px=0,px=03frt\l" - Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp") Found URL "http://morkaj.bet:8768/morkaj.bet?\c:\w:\windows\system32\pku2u.dll:\windows\system32\wdigest.dllecurity=impersonation" - Source: "00000000-00001516.00000001.196919.37DF0000.00000004.mdmp") Found URL "http://morkaj.bet:8768/8768/c:\windows\system32\ondemandconnroutehelper.dllc:\windows\system32\ondemandconnroutehelper.dllhttp://morkaj.bet:8768/c:\windows\system32\ondemandconnroutehelper.dllc:\windows\system32\ondemandconnroutehelper.dllc:\windows\system32\ondemandconnroutehelper.dll9andhttp://morkaj.bet:8768/9andhttp://morkaj.bet:8768/8768/http://morkaj.bet:8768/http://morkaj.bet:8768/http://morkaj.bet:8768/t" - Source: "00000000-00001516.00000001.196919.37DF0000.00000004.mdmp") Found URL "http://mormorkaj.bet:8768" - Source: "00000000-00001516.00000001.196919.37DF0000.00000004.mdmp") Found URL "http://morkaj.bet:8768/morkaj.bethttp://morkaj.bet:8768/morkaj.betorkaj.betorkaj.bet:\windows\system32\ondemandconnroutehelper.dllcal" - Source: "00000000-00001516.00000001.196919.37DF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001516.00000001.196919.37DF0000.00000004.mdmp") Found URL "http://morkaj.bet:8768!this" - Source: "00000000-00001516.00000001.196919.40000000.00000040.mdmp") Found URL "http://morkaj.bet:8768/http://morkaj.bet:8768/http://morkaj.bet:8768/http://morkaj.bet:8768/9andhttp://morkaj.bet:8768/c:\windows\system32\ondemandconnroutehelper.dll9andhttp://morkaj.bet:8768/c:\windows\system32\ondemandconnroutehelper.dllc:\windows\system32\ondemandconnroutehelper.dllhttp://morkaj.bet:8768/http://morkaj.bet:8768/c:\windows\system32\ondemandconnroutehelper.dllc:\windows\system32\ondemandconnroutehelper.dllc:\windows\system32\ondemandconnroutehelper.dllorkaj.betmorkaj.bet:8768" - Source: "00000000-00001516.00000002.198840.37DF0000.00000004.mdmp") Found URL "http://morkaj.bet:8768/morkaj.betorkaj.betcal" - Source: "00000000-00001516.00000002.198840.37DF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001516.00000002.198840.37DF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001516.00000003.199577.37DF0000.00000004.mdmp") Found URL "http://morkaj.bet:8768/http://morkaj.bet:8768/http://morkaj.bet:8768/http://morkaj.bet:8768/9andhttp://morkaj.bet:8768/c:\windows\system32\ondemandconnroutehelper.dll9andhttp://morkaj.bet:8768/c:\windows\system32\ondemandconnroutehelper.dllc:\windows\system32\ondemandconnroutehelper.dllhttp://morkaj.bet:8768/http://morkaj.bet:8768/c:\windows\system32\ondemandconnroutehelper.dllc:\windows\system32\ondemandconnroutehelper.dllc:\windows\system32\ondemandconnroutehelper.dlltimrendphtepscheapiot:8768/apioc2936e2apioapioc2936e2apioapioaliveapioapioapio-cacheapioapioapioapioapioapiocoreapioapioc2936e2apio8768/apioapioapioapiot:8768/apioapioapioapiot:8768/apioapioaliveapioapiot:8768/apioaliveapiot:8768/apioapioapiot:8768/apioapiot:8768/access-control-allow-credentialstruepersistent-authwww-authenticateoriginvaryset-cookienginxserverretry-afterproxy-supportproxy-authenticatelocationetagauthentication-infoaccept-rangeslast-modifiedexpirescontent-rangecontent-md5content-locationcontent-languagecontent-encodingcontent-typecontent-lengthallowwarningupgradetransfer-encodingtrailerpragmakeep-alivewed," - Source: "00000000-00001516.00000003.199577.37E80000.00000004.mdmp") Found URL "http://morkaj.bet:8768/morkaj.betorkaj.betcal" - Source: "00000000-00001516.00000003.199577.37E9E000.00000004.mdmp")3e:T50e,Found string "POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp, 00000000-00001516.00000001.196919.37DF0000.00000004.mdmp, 00000000-00001516.00000002.198840.37DF0000.00000004.mdmp, 00000000-00001516.00000003.199577.37E80000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp, 00000000-00001516.00000002.198840.37DF0000.00000004.mdmp, 00000000-00001516.00000003.199577.37E36000.00000004.mdmp") Found string "{"success":true}HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp, 00000000-00001516.00000001.196919.37DF0000.00000004.mdmp, 00000000-00001516.00000002.198840.37DF0000.00000004.mdmp, 00000000-00001516.00000003.199577.37DF0000.00000004.mdmp, 00000000-00001516.00000003.199577.37E36000.00000004.mdmp") Found string "success":true}HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00001516.00000002.198840.37DF0000.00000004.mdmp 00000000-00001516.00000003.199577.37DF0000.00000004.mdmp"), Found string "ss":true}HTTP/1.1 200 O" (Indicator: "HTTP/1.1"; Source: "00000000-00001516.00000002.198840.37DF0000.00000004.mdmp, 00000000-00001516.00000003.199577.37E9E000.00000004.mdmp")3f:T46f,Found string "+ncalrpc:[OLEB6185EC9C09036CDCC6FD4E463E1]" (Indicator: "ncalrpc"; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp, 00000000-00001516.00000001.196919.37DF0000.00000004.mdmp, 00000000-00001516.00000002.198840.37DF0000.00000004.mdmp, 00000000-00001516.00000003.199577.37E36000.00000004.mdmp") Found string "B+ncalrpc:[OLE07EFD61C74132051E2DB9C2DA2A9]" (Indicator: "ncalrpc"; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp, 00000000-00001516.00000001.196919.37DF0000.00000004.mdmp, 00000000-00001516.00000002.198840.37DF0000.00000004.mdmp, 00000000-00001516.00000003.199577.37E36000.00000004.mdmp") Found string "+ncalrpc:[OLE07EFD61C74132051E2DB9C2DA2A9]" (Indicator: "ncalrpc"; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp, 00000000-00001516.00000001.196919.37DF0000.00000004.mdmp, 00000000-00001516.00000002.198840.37DF0000.00000004.mdmp, 00000000-00001516.00000003.199577.37E36000.00000004.mdmp")40:T4be,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp, 00000000-00001516.00000001.196919.37DF0000.00000004.mdmp, 00000000-00001516.00000002.198840.37DF0000.00000004.mdmp, 00000000-00001516.00000003.199577.37E36000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp, 00000000-00001516.00000001.196919.37DF0000.00000004.mdmp, 00000000-00001516.00000002.198840.37DF0000.00000004.mdmp, 00000000-00001516.00000003.199577.37E36000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp, 00000000-00001516.00000001.196919.37DF0000.00000004.mdmp, 00000000-00001516.00000002.198840.37DF0000.00000004.mdmp, 00000000-00001516.00000003.199577.37E36000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001516.00000000.194998.37DF0000.00000004.mdmp, 00000000-00001516.00000001.196919.37DF0000.00000004.mdmp, 00000000-00001516.00000002.198840.37DF0000.00000004.mdmp, 00000000-00001516.00000003.199577.37E36000.00000004.mdmp")41:T6b8,file/memory contains long string with (Indicator: "GetUserName"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00001516.00000001.196919.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp")42:Tf6e,Found string "chacha8" (Indicator: "chacha"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "aes"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "aeshashbody" (Indicator: "aes"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "internal/chacha8rand/chacha8_amd64.s" (Indicator: "chacha"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp, 00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp, 00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp, 00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found string "internal/chacha8rand.block" (Indicator: "chacha"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp, 00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp, 00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found string "aeshashbody" (Indicator: "aes"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp, 00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found string "runtime.useAeshash" (Indicator: "aes"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp") Found string "runtime.aeskeysched" (Indicator: "aes"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp") Found string ":"BuTKMWvkpzFr5KAxZOSpMWDkpTFg5KkxaeSkMW3kqzFo5KQxbOSlMWjkrDFr5KAxbOSrMWzkujFq5KYxYuSuMWTkrTE=" (Indicator: "aes"; Source: "00000000-00001516.00000001.196919.37EBE000.00000004.mdmp"), Found string ":"8YTYepaEuXqXhLB6mYSzepaEsHqThL56m4SyepqEvXqYhL16n4S8epmEtHqehL56kISyep6Es3qBhLl6l4S0epyEs3o=" (Indicator: "aes"; Source: "00000000-00001516.00000001.196919.37EBE000.00000004.mdmp")43:T5c4,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "Process32First"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp")44:T51c,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "GetProcAddress"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp, 00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp, 00000000-00001516.00000002.198840.013D8000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001516.00000001.196919.01508000.00000002.mdmp") file/memory contains long string with (Indicator: "GetProcAddress"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp")45:T4ab,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "00000000-00001516.00000002.198840.013D8000.00000002.mdmp")46:T64d," "access_token=&debug=http://morkaj.bet:8768-74" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:09 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 74 Host: morkaj.bet:8768" with payload::==> "tag=733f5628b8ea274a1bdb466890f93f90&hwid=86dad1c5483efbe98bc17055f1d0373f" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:09 GMT Content-Type: application/octet-stream Content-Length: 117 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"75-5Bh49TLI0H6iFsOP8dmDEc7ohJ8" with response body ==>C3AEC3AC4F02C287C2B30BC29A296AC2B90E7E081BC28DC28AC29A1F2E48C384C39B6F3D296F1B0507C2BAC3A460C390C39C14C388C3922EC39501C3A7C3AEC3....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=http://morkaj.bet:8768-911" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:10 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=96Nk3ZP4XuL9k4Lu User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 911 Host: morkaj.bet:8768" with payload::==> "--96Nk3ZP4XuL9k4LuContent-Disposition: form-data; name="access_token"c74b2d52-3815-413a-a778-dd1a84b6a2a3--96Nk3ZP4XuL9k4LuContent-Disposition: form-data; name="type"0--96Nk3ZP4XuL9k4LuContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-stream"ñÝBØÇí°ÿ8ÝçÊAÂÄp'xfr!Ö³jÐS]y5$¹¤üÐ}óvYré¦G¹ÒGö«øÔDEÙµÐG¾ eo°èkwÕ²¦¤ø[P§M*xÌ»ñ£ÖkÛïV[¾©áîúå4ÎÏø{ª·4¼¯Ô³ÂÙt§N%!ºãÌÑìÔ¼w¬{eú:¼Íá»ÈKéÂ°îÝ] ±XêcÞÐO5GkH09Z}-Y°j0\@¯»b/ÁÂ·F¬ÄÅÄÖ§LëÝ¸8x4Øâu9ÑY3øp2¤/T°i½áßñÛàwPxÖ5FÀ/©P ¬à÷ªÇl¾ãWì#yîå·ú¢/ý§fÿãW «ÕèT]yjù ½è¶+¶Ò¥³àMQ¥ÈJZ¦Þó ×Ò&È^°Ø*ÝÄÿ;zf·Þ2´TK=toyJrWgFºIaÜëí PùÎÂSähg^*ÐÓÖXRe3âóDqeôd¯¥6Ø«ÜÚ=å}µ#Ì7ìp¦&ÄÝêdvÑ&ð"ÌH>ýwuÕG<·v]4ÚGúýt8¯97Éb}»vÛËÐóûüäãL=³I³øRï\J×¤)):Q¾¾\T-Çaß4²RKùá7yüf%ýâ:ÿa¤º--96Nk3ZP4XuL9k4Lu--" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:11 GMT Content-Length: 8 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true with response body ==>7265636569766564....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=http://morkaj.bet:8768-56" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:11 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&step=1" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:12 GMT Content-Type: application/octet-stream Content-Length: 2457 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"999-ezNoy5jSt1NZLDmImXGiOPomK9A" with response body ==>38C28BC2A67177C3B30BC2A93842C2BD0C77062570C286370C24C2990909C3A87FC395C3B3C28B5FC29C583EC3A2C2AE2DC3BEC3B45D5927C38450C28A33C28A....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=http://morkaj.bet:8768-56" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:13 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&step=2" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:14 GMT Content-Type: application/octet-stream Content-Length: 4686 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"124e-1cO89tMpxjyIgFshf8PP8YS6FLI" with response body ==>29C389C3B845C2B0C3BE6916C39AC2A076004FC2883952C29B354AC298C29F16C2B5C294C3B005C3AEC29012C281145EC3831360C2A8C2A41EC29BC3BFC39860....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=http://morkaj.bet:8768-56" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:15 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&step=3" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:16 GMT Content-Type: application/octet-stream Content-Length: 6390 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"18f6-1ddPlWLN7QyRG92aEe3zTelrx7I" with response body ==>C2A3C2ACC2985B003FC28B092E62C297C39AC3BFC297C2A7C2BC5FC3A5C389C2B93CC3A4665BC282085E53C3B242C3B7C3AEC3ADC2A2317DC2A154C286C38CC2....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=http://morkaj.bet:8768-56" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:17 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&step=4" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:19 GMT Content-Type: application/octet-stream Content-Length: 7764 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"1e54-JXJzPDi44D6CY8cFPmEjERGJqI4" with response body ==>C2B252C3B3C28D37C3ADC3ACC3BFC39BC38F1B754374582F4324C289C2A2C39D1CC2BAC29C4C0CC383C2A3C3BB35C2A3C28619C390C3BBC284C3A003714BC28E....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=http://morkaj.bet:8768-56" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:20 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&step=5" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:21 GMT Content-Type: application/octet-stream Content-Length: 44334 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"ad2e-tyUPFftMg7s9+m4KOnHp2z28NOg" with response body ==>C3ABC3AA68C295C2B122033C7B3A0018C3B213C38CC2AFC390C2A84608C29B3D22C3BEC2BEC3BCC2B3106B52C284C2B4C3877E507C5C0D7FC3A2C3A2023422C2....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:23 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:24 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:24 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:25 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:26 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:26 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:27 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:28 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:28 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:29 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: morkaj.bet:8768" with payload::==> "access_token=c74b2d52-3815-413a-a778-dd1a84b6a2a3&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 22 Apr 2026 05:35:29 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D.......1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":86,"unified_at_epoch_ms":1790713901377,"unified_at":"2026-09-29T20:31:41.377Z","metadata":{"hashes":{"sha256":"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff","sha1":"cae8ffaf111e2c58f55c4bf821fedbb9ccfcf4db","md5":"7e085b025285bdd2736a1421745bf542","sha512":"81677898b163aca5f2bcb650a39191221700dd04a15765773abe8aa0190f70d28f9cb8a838a9d69b5715a51e5d61e61c05af41c787d93f36cd95178f0c08c561","ssdeep":"24576:1/6y+xHNllicfAJ85/a3BtXvTedeQOxmLMDhqG6WcRDzQG:1/kxHJfA/3B1vTen3ghOJF","ssdeep_chunks":["24576:1/6y+xH","24576:/6y+xHN","24576:6y+xHNl","24576:y+xHNll","24576:+xHNlli","24576:xHNllic","24576:HNllicf","24576:NllicfA","24576:llicfAJ","24576:licfAJ8","24576:icfAJ85","24576:cfAJ85/","24576:fAJ85/a","24576:AJ85/a3","24576:J85/a3B","24576:85/a3Bt","24576:5/a3BtX","24576:/a3BtXv","24576:a3BtXvT","24576:3BtXvTe","24576:BtXvTed","24576:tXvTede","24576:XvTedeQ","24576:vTedeQO","24576:TedeQOx","24576:edeQOxm","24576:deQOxmL","24576:eQOxmLM","24576:QOxmLMD","24576:OxmLMDh","24576:xmLMDhq","24576:mLMDhqG","24576:LMDhqG6","24576:MDhqG6W","24576:DhqG6Wc","24576:hqG6WcR","24576:qG6WcRD","24576:G6WcRDz","24576:6WcRDzQ","24576:WcRDzQG","49152:1/6y+xH","49152:/6y+xHN","49152:6y+xHNl","49152:y+xHNll","49152:+xHNlli","49152:xHNllic","49152:HNllicf","49152:NllicfA","49152:llicfAJ","49152:licfAJ8","49152:icfAJ85","49152:cfAJ85/","49152:fAJ85/a","49152:AJ85/a3","49152:J85/a3B","49152:85/a3Bt","49152:5/a3BtX","49152:/a3BtXv","49152:a3BtXvT","49152:3BtXvTe","49152:BtXvTed","49152:tXvTede","49152:XvTedeQ","49152:vTedeQO","49152:TedeQOx","49152:edeQOxm","49152:deQOxmL","49152:eQOxmLM","49152:QOxmLMD","49152:OxmLMDh","49152:xmLMDhq","49152:mLMDhqG","49152:LMDhqG6","49152:MDhqG6W","49152:DhqG6Wc","49152:hqG6WcR","49152:qG6WcRD","49152:G6WcRDz","49152:6WcRDzQ","49152:WcRDzQG","24576:1/kxHJf","24576:/kxHJfA","24576:kxHJfA/","24576:xHJfA/3","24576:HJfA/3B","24576:JfA/3B1","24576:fA/3B1v","24576:A/3B1vT","24576:/3B1vTe","24576:3B1vTen","24576:B1vTen3","24576:1vTen3g","24576:vTen3gh","24576:Ten3ghO","24576:en3ghOJ","24576:n3ghOJF"],"imphash":"d42595b695fc008ef2c56aabd8efd68e"},"file_info":{"file_name":"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":1971400,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1776836069000,"last_seen":1776836076000,"last_multi_scan":1776836076000}},"detections":{"summary":{"verdict":"malicious","score":86,"tags":["credentialharvesting","commodity","lummastealer","criminal","informationstealer","malicious","evasive"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":69},"sandbox_signatures":{"informative_count":139,"suspicious_count":7,"malicious_count":7,"total":153},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Loader.pg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Upload file using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"},{"type":"malicious","value":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; Source: \"00000000-00001516.00000002.198840.013D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001516.00000002.198840.013D8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; Source: \"00000000-00001516.00000001.196919.01508000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001516.00000001.196919.40000000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$47","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00001516.00000000.194998.37DF0000.00000004.mdmp, 00000000-00001516.00000001.196919.37DF0000.00000004.mdmp, 00000000-00001516.00000002.198840.37DF0000.00000004.mdmp, 00000000-00001516.00000003.199577.37DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\" \"tag=733f5628b8ea274a1bdb466890f93f90&hwid=86dad1c5483efbe98bc17055f1d0373f\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69e85deb0ff8f02b08077b31"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"\"