IsElevated false Member true [INFO] 2020-09-20T03:26:49+01:00 Loaded embedded config [INFO] 2020-09-20T03:26:49+01:00 Autoexec with parameters: [artifacts collect Collector --logfile Collector_velociraptor.exe.log -v --nobanner --require_admin --prompt] [INFO] 2020-09-20T03:26:49+01:00 Loaded embedded config [INFO] 2020-09-20T03:26:49+01:00 Starting Journal service. [INFO] 2020-09-20T03:26:49+01:00 Starting the notification service. [INFO] 2020-09-20T03:26:49+01:00 Installing Dummy inventory_service. Will download tools to temp directory. [INFO] 2020-09-20T03:26:49+01:00 Loaded 189 built in artifacts in 53.0004ms [INFO] 2020-09-20T03:26:49+01:00 Adding tool CCXYaraRules [INFO] 2020-09-20T03:26:49+01:00 Compiled all artifacts. [INFO] 2020-09-20T03:26:50+01:00 Will collect package Collection-DESKTOP-R3AQE0V-2020-09-20_03_26_50__0100_BST [INFO] 2020-09-20T03:26:50+01:00 Starting collection of Collector [INFO] 2020-09-20T03:26:50+01:00 Will create container at Collection-DESKTOP-R3AQE0V-2020-09-20_03_26_50__0100_BST.zip [INFO] 2020-09-20T03:26:50+01:00 Starting collection of Packs.CyberCX.Reports [INFO] 2020-09-20T03:26:50+01:00 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [INFO] 2020-09-20T03:26:50+01:00 .d8888b. .d8888b. Y88b d88P 8888888b. d8b [INFO] 2020-09-20T03:26:50+01:00 d88P Y88b d88P Y88b Y88b d88P 888 "Y88b Y8P [INFO] 2020-09-20T03:26:50+01:00 888 888 888 888 Y88o88P 888 888 [INFO] 2020-09-20T03:26:50+01:00 888 888 Y888P 888 888 888 .d88b. .d88b. .d88b. 888d888 [INFO] 2020-09-20T03:26:50+01:00 888 888 d888b 888 888 888 d88P"88b d88P"88b d8P Y8b 888P" [INFO] 2020-09-20T03:26:50+01:00 888 888 888 888 d88888b 888 888 888 888 888 888 888 88888888 888 [INFO] 2020-09-20T03:26:50+01:00 Y88b d88P Y88b d88P d88P Y88b 888 .d88P 888 Y88b 888 Y88b 888 Y8b. 888 [INFO] 2020-09-20T03:26:50+01:00 "Y8888P" "Y8888P" d88P Y88b 8888888P" 888 "Y88888 "Y88888 "Y8888 888 [INFO] 2020-09-20T03:26:50+01:00 888 888 [INFO] 2020-09-20T03:26:50+01:00 Y8b d88P Y8b d88P [INFO] 2020-09-20T03:26:50+01:00 "Y88P" "Y88P" [INFO] 2020-09-20T03:26:50+01:00 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [INFO] 2020-09-20T03:26:50+01:00 Running CCX Digger against the local system. [INFO] 2020-09-20T03:26:50+01:00 For more information, please refer to https://github.com/CCXLabs/CCXDigger [INFO] 2020-09-20T03:26:50+01:00 [INFO] 2020-09-20T03:26:50+01:00 Collected Packs.CyberCX.Reports [INFO] 2020-09-20T03:26:50+01:00 Starting collection of Packs.CyberCX.Windows.ExecutionsTimeline/UserAssist [INFO] 2020-09-20T03:26:50+01:00 LookupSID: No mapping between account names and security IDs was done. [INFO] 2020-09-20T03:26:50+01:00 LookupSID: No mapping between account names and security IDs was done. [INFO] 2020-09-20T03:26:50+01:00 LookupSID: No mapping between account names and security IDs was done. [INFO] 2020-09-20T03:26:53+01:00 Collected Packs.CyberCX.Windows.ExecutionsTimeline/UserAssist [INFO] 2020-09-20T03:26:53+01:00 Starting collection of Packs.CyberCX.Windows.ExecutionsTimeline/Timeline [INFO] 2020-09-20T03:26:53+01:00 Collected Packs.CyberCX.Windows.ExecutionsTimeline/Timeline [INFO] 2020-09-20T03:26:53+01:00 Starting collection of Packs.CyberCX.Windows.ExecutionsTimeline/RecentApps [INFO] 2020-09-20T03:26:53+01:00 Collected Packs.CyberCX.Windows.ExecutionsTimeline/RecentApps [INFO] 2020-09-20T03:26:53+01:00 Starting collection of Packs.CyberCX.Windows.ExecutionsTimeline/ShimCache [INFO] 2020-09-20T03:26:53+01:00 Collected Packs.CyberCX.Windows.ExecutionsTimeline/ShimCache [INFO] 2020-09-20T03:26:53+01:00 Starting collection of Packs.CyberCX.Windows.ExecutionsTimeline/Prefetch [INFO] 2020-09-20T03:26:55+01:00 Collected Packs.CyberCX.Windows.ExecutionsTimeline/Prefetch [INFO] 2020-09-20T03:26:55+01:00 Starting collection of Packs.CyberCX.Windows.ExecutionsTimeline/SRUM [INFO] 2020-09-20T03:26:55+01:00 Parsing SruDbIdMapTable for c:\windows\system32\sru\srudb.dat [INFO] 2020-09-20T03:26:55+01:00 Parsed c:\windows\system32\sru\srudb.dat successfully with 0 records [INFO] 2020-09-20T03:26:55+01:00 Collected Packs.CyberCX.Windows.ExecutionsTimeline/SRUM [INFO] 2020-09-20T03:26:55+01:00 Scanning for IIS logs in glob *:/inetpub/logs/**3/*.log [INFO] 2020-09-20T03:26:55+01:00 Starting collection of Packs.CyberCX.Windows.IISLogs [INFO] 2020-09-20T03:26:55+01:00 Collected Packs.CyberCX.Windows.IISLogs [INFO] 2020-09-20T03:26:55+01:00 Starting collection of Packs.CyberCX.Windows.ScheduledTasks [INFO] 2020-09-20T03:26:58+01:00 Collected Packs.CyberCX.Windows.ScheduledTasks [INFO] 2020-09-20T03:26:58+01:00 Starting collection of Packs.CyberCX.Windows.ServiceEventLogs runtime: goroutine stack exceeds 1000000000-byte limit runtime: sp=0xc046701330 stack=[0xc046700000, 0xc066700000] fatal error: stack overflow runtime stack: runtime.throw(0x1b3dca1, 0xe) /home/mic/build/go/src/runtime/panic.go:1116 +0x79 runtime.newstack() /home/mic/build/go/src/runtime/stack.go:1034 +0x6dc runtime.morestack() /home/mic/build/go/src/runtime/asm_amd64.s:449 +0x97 goroutine 3127 [running]: runtime.mapaccess2_fast64(0x18edec0, 0xc000a965a0, 0xc717e000, 0x0, 0x0) /home/mic/build/go/src/runtime/map_fast64.go:52 +0x1b2 fp=0xc046701340 sp=0xc046701338 pc=0x413bd2 www.velocidex.com/golang/go-ntfs/parser.(*LRU).Get(0xc000a965d0, 0xc717e000, 0x0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/lru.go:92 +0x9b fp=0xc046701398 sp=0xc046701340 pc=0x129d1cb www.velocidex.com/golang/go-ntfs/parser.(*PagedReader).ReadAt(0xc000b24200, 0xc083504098, 0x2, 0x2, 0xc717f01c, 0x0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/reader.go:48 +0x13f fp=0xc0467014c0 sp=0xc046701398 pc=0x12b2eff www.velocidex.com/golang/go-ntfs/parser.(*RangeReader).readFromARun(0xc000ac49a0, 0x1, 0xc083504098, 0x2, 0x2, 0x17f01c, 0x417dad, 0x34d68400, 0x100) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:591 +0xd6 fp=0xc046701558 sp=0xc0467014c0 pc=0x12957b6 www.velocidex.com/golang/go-ntfs/parser.(*RangeReader).ReadAt(0xc000ac49a0, 0xc083504098, 0x2, 0x2, 0x617f01c, 0x0, 0xc046701688, 0x419d25) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:619 +0xfa fp=0xc046701610 sp=0xc046701558 pc=0x1295aaa www.velocidex.com/golang/go-ntfs/parser.(*RangeReader).readFromARun(0xc000ac49c0, 0x0, 0xc083504098, 0x2, 0x2, 0x617f01c, 0x34cbd350, 0xc046701780, 0xc000080a80) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:591 +0xd6 fp=0xc0467016a8 sp=0xc046701610 pc=0x12957b6 www.velocidex.com/golang/go-ntfs/parser.(*RangeReader).ReadAt(0xc000ac49c0, 0xc083504098, 0x2, 0x2, 0x617f01c, 0x453896, 0xb0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:619 +0xfa fp=0xc046701760 sp=0xc0467016a8 pc=0x1295aaa www.velocidex.com/golang/go-ntfs/parser.ParseUint16(0x1ead500, 0xc000ac49c0, 0x617f01c, 0xa9) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/ntfs_gen.go:1699 +0x89 fp=0xc0467017b8 sp=0xc046701760 pc=0x12b21d9 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).Mft_entry_allocated(...) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/ntfs_gen.go:681 www.velocidex.com/golang/go-ntfs/parser.FixUpDiskMFTEntry(0xc0467018a8, 0x8, 0xc0467018c8, 0x12b2379, 0xc0834d9830) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/boot.go:32 +0x67 fp=0xc046701860 sp=0xc0467017b8 pc=0x12971c7 www.velocidex.com/golang/go-ntfs/parser.(*NTFSContext).GetMFT(0xc000b24240, 0x185fc, 0x10, 0x30000000185fc, 0x8) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/context.go:36 +0x9e fp=0xc0467018d8 sp=0xc046701860 pc=0x1297e3e www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc0467019f8, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:722 +0xdf fp=0xc046701940 sp=0xc0467018d8 pc=0x129679f www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046701ae0, 0xc000b24240, 0xc0834f51a0, 0xc0834f5200, 0x1, 0xc0832b7c78, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046701a28 sp=0xc046701940 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f51a0, 0xc000b24240, 0xc0834f51a0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046701b10 sp=0xc046701a28 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046701c30, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046701b78 sp=0xc046701b10 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046701d18, 0xc000b24240, 0xc0834f50c0, 0xc0834f5120, 0x1, 0xc0832b7c70, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046701c60 sp=0xc046701b78 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f50c0, 0xc000b24240, 0xc0834f50c0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046701d48 sp=0xc046701c60 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046701e68, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046701db0 sp=0xc046701d48 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046701f50, 0xc000b24240, 0xc0834f4fe0, 0xc0834f5040, 0x1, 0xc0832b7c68, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046701e98 sp=0xc046701db0 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4fe0, 0xc000b24240, 0xc0834f4fe0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046701f80 sp=0xc046701e98 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc0467020a0, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046701fe8 sp=0xc046701f80 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046702188, 0xc000b24240, 0xc0834f4f00, 0xc0834f4f60, 0x1, 0xc0832b7c60, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc0467020d0 sp=0xc046701fe8 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4f00, 0xc000b24240, 0xc0834f4f00, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc0467021b8 sp=0xc0467020d0 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc0467022d8, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046702220 sp=0xc0467021b8 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc0467023c0, 0xc000b24240, 0xc0834f4e20, 0xc0834f4e80, 0x1, 0xc0832b7c58, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046702308 sp=0xc046702220 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4e20, 0xc000b24240, 0xc0834f4e20, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc0467023f0 sp=0xc046702308 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046702510, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046702458 sp=0xc0467023f0 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc0467025f8, 0xc000b24240, 0xc0834f4d40, 0xc0834f4da0, 0x1, 0xc0832b7c50, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046702540 sp=0xc046702458 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4d40, 0xc000b24240, 0xc0834f4d40, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046702628 sp=0xc046702540 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046702748, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046702690 sp=0xc046702628 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046702830, 0xc000b24240, 0xc0834f4c60, 0xc0834f4cc0, 0x1, 0xc0832b7c48, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046702778 sp=0xc046702690 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4c60, 0xc000b24240, 0xc0834f4c60, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046702860 sp=0xc046702778 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046702980, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc0467028c8 sp=0xc046702860 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046702a68, 0xc000b24240, 0xc0834f4b80, 0xc0834f4be0, 0x1, 0xc0832b7c40, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc0467029b0 sp=0xc0467028c8 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4b80, 0xc000b24240, 0xc0834f4b80, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046702a98 sp=0xc0467029b0 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046702bb8, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046702b00 sp=0xc046702a98 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046702ca0, 0xc000b24240, 0xc0834f4aa0, 0xc0834f4b00, 0x1, 0xc0832b7c38, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046702be8 sp=0xc046702b00 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4aa0, 0xc000b24240, 0xc0834f4aa0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046702cd0 sp=0xc046702be8 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046702df0, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046702d38 sp=0xc046702cd0 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046702ed8, 0xc000b24240, 0xc0834f49c0, 0xc0834f4a20, 0x1, 0xc0832b7c30, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046702e20 sp=0xc046702d38 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f49c0, 0xc000b24240, 0xc0834f49c0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046702f08 sp=0xc046702e20 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046703028, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046702f70 sp=0xc046702f08 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046703110, 0xc000b24240, 0xc0834f48e0, 0xc0834f4940, 0x1, 0xc0832b7c28, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046703058 sp=0xc046702f70 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f48e0, 0xc000b24240, 0xc0834f48e0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046703140 sp=0xc046703058 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046703260, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc0467031a8 sp=0xc046703140 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046703348, 0xc000b24240, 0xc0834f4800, 0xc0834f4860, 0x1, 0xc0832b7c20, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046703290 sp=0xc0467031a8 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4800, 0xc000b24240, 0xc0834f4800, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046703378 sp=0xc046703290 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046703498, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc0467033e0 sp=0xc046703378 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046703580, 0xc000b24240, 0xc0834f4720, 0xc0834f4780, 0x1, 0xc0832b7c18, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc0467034c8 sp=0xc0467033e0 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4720, 0xc000b24240, 0xc0834f4720, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc0467035b0 sp=0xc0467034c8 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc0467036d0, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046703618 sp=0xc0467035b0 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc0467037b8, 0xc000b24240, 0xc0834f4640, 0xc0834f46a0, 0x1, 0xc0832b7c10, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046703700 sp=0xc046703618 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4640, 0xc000b24240, 0xc0834f4640, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc0467037e8 sp=0xc046703700 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046703908, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046703850 sp=0xc0467037e8 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc0467039f0, 0xc000b24240, 0xc0834f4560, 0xc0834f45c0, 0x1, 0xc0832b7c08, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046703938 sp=0xc046703850 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4560, 0xc000b24240, 0xc0834f4560, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046703a20 sp=0xc046703938 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046703b40, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046703a88 sp=0xc046703a20 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046703c28, 0xc000b24240, 0xc0834f4480, 0xc0834f44e0, 0x1, 0xc0832b7c00, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046703b70 sp=0xc046703a88 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4480, 0xc000b24240, 0xc0834f4480, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046703c58 sp=0xc046703b70 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046703d78, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046703cc0 sp=0xc046703c58 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046703e60, 0xc000b24240, 0xc0834f43a0, 0xc0834f4400, 0x1, 0xc0832b7bf8, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046703da8 sp=0xc046703cc0 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f43a0, 0xc000b24240, 0xc0834f43a0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046703e90 sp=0xc046703da8 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046703fb0, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046703ef8 sp=0xc046703e90 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046704098, 0xc000b24240, 0xc0834f42c0, 0xc0834f4320, 0x1, 0xc0832b7bf0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046703fe0 sp=0xc046703ef8 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f42c0, 0xc000b24240, 0xc0834f42c0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc0467040c8 sp=0xc046703fe0 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc0467041e8, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046704130 sp=0xc0467040c8 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc0467042d0, 0xc000b24240, 0xc0834f41e0, 0xc0834f4240, 0x1, 0xc0832b7be8, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046704218 sp=0xc046704130 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f41e0, 0xc000b24240, 0xc0834f41e0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046704300 sp=0xc046704218 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046704420, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046704368 sp=0xc046704300 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046704508, 0xc000b24240, 0xc0834f4100, 0xc0834f4160, 0x1, 0xc0832b7be0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046704450 sp=0xc046704368 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4100, 0xc000b24240, 0xc0834f4100, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046704538 sp=0xc046704450 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046704658, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc0467045a0 sp=0xc046704538 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046704740, 0xc000b24240, 0xc0834f4020, 0xc0834f4080, 0x1, 0xc0832b7bd8, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046704688 sp=0xc0467045a0 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834f4020, 0xc000b24240, 0xc0834f4020, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046704770 sp=0xc046704688 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046704890, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc0467047d8 sp=0xc046704770 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046704978, 0xc000b24240, 0xc0834ddf40, 0xc0834ddfa0, 0x1, 0xc0832b7bd0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc0467048c0 sp=0xc0467047d8 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834ddf40, 0xc000b24240, 0xc0834ddf40, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc0467049a8 sp=0xc0467048c0 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046704ac8, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046704a10 sp=0xc0467049a8 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046704bb0, 0xc000b24240, 0xc0834dde60, 0xc0834ddec0, 0x1, 0xc0832b7bc8, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046704af8 sp=0xc046704a10 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834dde60, 0xc000b24240, 0xc0834dde60, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046704be0 sp=0xc046704af8 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046704d00, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046704c48 sp=0xc046704be0 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046704de8, 0xc000b24240, 0xc0834ddd80, 0xc0834ddde0, 0x1, 0xc0832b7bc0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046704d30 sp=0xc046704c48 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834ddd80, 0xc000b24240, 0xc0834ddd80, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046704e18 sp=0xc046704d30 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046704f38, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046704e80 sp=0xc046704e18 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046705020, 0xc000b24240, 0xc0834ddca0, 0xc0834ddd00, 0x1, 0xc0832b7bb8, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046704f68 sp=0xc046704e80 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834ddca0, 0xc000b24240, 0xc0834ddca0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046705050 sp=0xc046704f68 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046705170, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc0467050b8 sp=0xc046705050 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046705258, 0xc000b24240, 0xc0834ddbc0, 0xc0834ddc20, 0x1, 0xc0832b7bb0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc0467051a0 sp=0xc0467050b8 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834ddbc0, 0xc000b24240, 0xc0834ddbc0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046705288 sp=0xc0467051a0 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc0467053a8, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc0467052f0 sp=0xc046705288 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046705490, 0xc000b24240, 0xc0834ddae0, 0xc0834ddb40, 0x1, 0xc0832b7ba8, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc0467053d8 sp=0xc0467052f0 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834ddae0, 0xc000b24240, 0xc0834ddae0, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc0467054c0 sp=0xc0467053d8 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc0467055e0, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046705528 sp=0xc0467054c0 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc0467056c8, 0xc000b24240, 0xc0834dda00, 0xc0834dda60, 0x1, 0xc0832b7ba0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046705610 sp=0xc046705528 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834dda00, 0xc000b24240, 0xc0834dda00, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc0467056f8 sp=0xc046705610 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046705818, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046705760 sp=0xc0467056f8 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046705900, 0xc000b24240, 0xc0834dd920, 0xc0834dd980, 0x1, 0xc0832b7b98, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046705848 sp=0xc046705760 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834dd920, 0xc000b24240, 0xc0834dd920, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046705930 sp=0xc046705848 pc=0x129f036 www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).GetAttribute(0xc046705a50, 0xc000b24240, 0x10, 0x30000000185fc, 0x60) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:726 +0x10a fp=0xc046705998 sp=0xc046705930 pc=0x12967ca www.velocidex.com/golang/go-ntfs/parser.(*ATTRIBUTE_LIST_ENTRY).Attributes(0xc046705b38, 0xc000b24240, 0xc0834dd840, 0xc0834dd8a0, 0x1, 0xc0832b7b90, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/attribute.go:694 +0x2d2 fp=0xc046705a80 sp=0xc046705998 pc=0x1296402 www.velocidex.com/golang/go-ntfs/parser.(*MFT_ENTRY).EnumerateAttributes(0xc0834dd840, 0xc000b24240, 0xc0834dd840, 0x0, 0x0) /home/mic/go/pkg/mod/www.velocidex.com/golang/go-ntfs@v0.0.0-20200808165039-c2a9c841abe3/parser/mft.go:38 +0x3b6 fp=0xc046705b68 sp=0xc046705a80 pc=0x129f036 created by www.velocidex.com/golang/velociraptor/glob.Globber.ExpandWithContext /home/mic/projects/velociraptor/glob/glob.go:258 +0xc5 goroutine 1 [chan receive]: main.outputJSON(0x1ed9540, 0xc0009bad00, 0xc00093bb80, 0xc0009bacc0, 0x1ead1a0, 0xc000006018) /home/mic/projects/velociraptor/bin/query.go:69 +0x142 main.eval_local_query(0xc00011dd10, 0x1b29308, 0x4, 0x1b9e041, 0x90, 0xc00093bb80) /home/mic/projects/velociraptor/bin/fs.go:110 +0x245 main.doArtifactCollect() /home/mic/projects/velociraptor/bin/artifacts.go:183 +0x801 main.init.0.func1(0xc000460f60, 0x11, 0x1e) /home/mic/projects/velociraptor/bin/artifacts.go:314 +0xae main.main() /home/mic/projects/velociraptor/bin/main.go:183 +0xf3d goroutine 14 [select]: go.opencensus.io/stats/view.(*worker).start(0xc000298480) /home/mic/go/pkg/mod/go.opencensus.io@v0.22.4/stats/view/worker.go:276 +0x107 created by go.opencensus.io/stats/view.init.0 /home/mic/go/pkg/mod/go.opencensus.io@v0.22.4/stats/view/worker.go:34 +0x6f goroutine 27 [chan receive]: www.velocidex.com/golang/velociraptor/services/journal.StartJournalService.func1(0xc000293180, 0x1ed9540, 0xc000247280) /home/mic/projects/velociraptor/services/journal/journal.go:87 +0x9e created by www.velocidex.com/golang/velociraptor/services/journal.StartJournalService /home/mic/projects/velociraptor/services/journal/journal.go:83 +0xed goroutine 28 [select]: www.velocidex.com/golang/velociraptor/services/notifications.StartNotificationService.func1(0x1bba318, 0xc000293180, 0xc00069d470, 0x1ed9540, 0xc000247280, 0x0) /home/mic/projects/velociraptor/services/notifications/notifications.go:78 +0x17e created by www.velocidex.com/golang/velociraptor/services/notifications.StartNotificationService /home/mic/projects/velociraptor/services/notifications/notifications.go:65 +0x21d goroutine 29 [chan receive]: www.velocidex.com/golang/velociraptor/services/inventory.StartInventoryDummyService.func1(0xc000293180, 0xc00046b860, 0xc00011dd10, 0x1ed9540, 0xc000247280) /home/mic/projects/velociraptor/services/inventory/dummy.go:345 +0xce created by www.velocidex.com/golang/velociraptor/services/inventory.StartInventoryDummyService /home/mic/projects/velociraptor/services/inventory/dummy.go:340 +0x204 goroutine 16 [chan receive]: www.velocidex.com/golang/velociraptor/services/repository.StartRepositoryManager.func2(0xc000293180, 0x1ed9540, 0xc000247280) /home/mic/projects/velociraptor/services/repository/manager.go:205 +0x9e created by www.velocidex.com/golang/velociraptor/services/repository.StartRepositoryManager /home/mic/projects/velociraptor/services/repository/manager.go:201 +0x321 goroutine 50 [chan receive]: www.velocidex.com/golang/velociraptor/services/launcher.StartLauncherService.func1(0xc000293180, 0x1ed9540, 0xc000247280) /home/mic/projects/velociraptor/services/launcher/launcher.go:344 +0x9e created by www.velocidex.com/golang/velociraptor/services/launcher.StartLauncherService /home/mic/projects/velociraptor/services/launcher/launcher.go:340 +0x75 goroutine 3123 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc000aeb680, 0x1ed9540, 0xc000a36180, 0xc000474c80, 0xc000fde000) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f goroutine 30 [syscall]: os/signal.signal_recv(0xc0009a5fae) /home/mic/build/go/src/runtime/sigqueue.go:147 +0xa3 os/signal.loop() /home/mic/build/go/src/os/signal/signal_unix.go:23 +0x29 created by os/signal.Notify.func1 /home/mic/build/go/src/os/signal/signal.go:127 +0x4b goroutine 31 [chan receive]: main.InstallSignalHandler.func1(0xc000066a20, 0xc00093bb80, 0xc000384490) /home/mic/projects/velociraptor/bin/utils.go:48 +0x3b created by main.InstallSignalHandler /home/mic/projects/velociraptor/bin/utils.go:46 +0x149 goroutine 32 [select]: www.velocidex.com/golang/vfilter.GetResponseChannel.func1(0xc00006a1e0, 0xc0009bacc0, 0x1ed9540, 0xc0009bad00, 0xc00093bb80, 0xc0003844a0, 0xa, 0xa) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/api.go:68 +0x2dd created by www.velocidex.com/golang/vfilter.GetResponseChannel /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/api.go:29 +0xb5 goroutine 33 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc0009bac00, 0x1ed9540, 0xc0009bad00, 0xc00093bb80, 0xc00006a240) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f goroutine 66 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc00006a3c0, 0xc000993530, 0xc00093bb80, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1215 +0x58e created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 67 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc00006a360, 0xc00006a3c0, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 52 [chan receive]: www.velocidex.com/golang/velociraptor/vql/tools.CollectPlugin.Call.func1(0xc00051c180, 0xc00093bb80, 0xc000064000, 0x1ed9540, 0xc0009bad00) /home/mic/projects/velociraptor/vql/tools/collector.go:239 +0x10d5 created by www.velocidex.com/golang/velociraptor/vql/tools.CollectPlugin.Call /home/mic/projects/velociraptor/vql/tools/collector.go:42 +0x8b goroutine 42 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc000b62b00, 0x1ed9540, 0xc0009bad00, 0xc00093b540, 0xc00051cd80) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f goroutine 43 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc00051cf00, 0xc0007e85d0, 0xc00093b540, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1152 +0xb7a created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 44 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc00051cde0, 0xc00051cf00, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 45 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc000b62900, 0x1ed9540, 0xc0009bad00, 0xc0005292c0, 0xc00051cf60) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f goroutine 46 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc00051d020, 0xc0007e83c0, 0xc0005292c0, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1215 +0x58e created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 47 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc00051cfc0, 0xc00051d020, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 48 [chan receive]: www.velocidex.com/golang/velociraptor/reporting.(*Container).StoreArtifact(0xc000bc0500, 0xc00011dd10, 0x1ed9540, 0xc0009bad00, 0xc000659400, 0xc00054d040, 0xc000067980, 0x1b2aa49, 0x5, 0xc0009bad00, ...) /home/mic/projects/velociraptor/reporting/container.go:124 +0x2e8 www.velocidex.com/golang/velociraptor/vql/tools.CollectPlugin.Call.func1(0xc00051d140, 0xc0005292c0, 0xc000b62c00, 0x1ed9540, 0xc0009bad00) /home/mic/projects/velociraptor/vql/tools/collector.go:250 +0xede created by www.velocidex.com/golang/velociraptor/vql/tools.CollectPlugin.Call /home/mic/projects/velociraptor/vql/tools/collector.go:42 +0x8b goroutine 3126 [chan receive]: www.velocidex.com/golang/velociraptor/vql/filesystem.GlobPlugin.Call.func1(0xc000fde600, 0xc000474c80, 0xc000b240c0, 0xc00008c000, 0x1ed9540, 0xc000a36180) /home/mic/projects/velociraptor/vql/filesystem/filesystem.go:108 +0x3b3 created by www.velocidex.com/golang/velociraptor/vql/filesystem.GlobPlugin.Call /home/mic/projects/velociraptor/vql/filesystem/filesystem.go:49 +0xcd goroutine 3089 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc000a42980, 0x1ed9540, 0xc0009bad00, 0xc0017a5180, 0xc00099b260) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f goroutine 3113 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc0017acae0, 0xc000b7ab70, 0xc000fd7e00, 0x1ed9540, 0xc000a42b80) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1215 +0x58e created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 3112 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc000a42340, 0x1ed9540, 0xc000a42b80, 0xc000fd7e00, 0xc0017aca20) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f goroutine 3079 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc00054d200, 0x1ed9540, 0xc0009bad00, 0xc000659400, 0xc00099ad20) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f goroutine 3080 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc00099ade0, 0xc000ad2f00, 0xc000659400, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1152 +0xb7a created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 3114 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc0017aca80, 0xc0017acae0, 0x1ed9540, 0xc000a42b80) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 3085 [chan receive]: www.velocidex.com/golang/velociraptor/services/repository.(*ArtifactRepositoryPlugin).Call.func1(0xc000a0d8b0, 0xc00099af60, 0xc000659900, 0x1ed9540, 0xc0009bad00, 0xc00054d280) /home/mic/projects/velociraptor/services/repository/plugin.go:196 +0xb5c created by www.velocidex.com/golang/velociraptor/services/repository.(*ArtifactRepositoryPlugin).Call /home/mic/projects/velociraptor/services/repository/plugin.go:76 +0xba goroutine 3116 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc0017acc60, 0xc000b7a660, 0xc000fd7e00, 0x1ed9540, 0xc000a42b80) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1215 +0x58e created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 3138 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc00099b320, 0xc000b0d710, 0xc0017a5180, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1152 +0xb7a created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 3141 [chan receive]: www.velocidex.com/golang/vfilter.(*_Select).Eval(0xc000a42600, 0x1ed9540, 0xc000a42b80, 0xc000fd7cc0, 0x2a84c870) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:653 +0x18b www.velocidex.com/golang/vfilter.(*_StoredQuery).Eval(0xc000b0ccf0, 0x1ed9540, 0xc000a42b80, 0xc0017a52c0, 0xc000b0ccf0) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/stored.go:54 +0x61 www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc00099b440, 0xc000b0d020, 0xc0017a52c0, 0x1ed9540, 0xc000a42b80) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1151 +0xb42 created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 3082 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc00054cf80, 0x1ed9540, 0xc0009bad00, 0xc000659900, 0xc00099ae40) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f goroutine 3087 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc00099b200, 0xc000b0d950, 0xc0017a4640, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1152 +0xb7a created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 3167 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc002d800c0, 0xc000a4cd20, 0xc000658c80, 0x1ed9540, 0xc000a36180) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1215 +0x58e created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 3110 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc0017ac8a0, 0xc0017ac900, 0x1ed9540, 0xc000a42b80) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 3140 [chan receive]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func1(0xc00099b380, 0x1ed9540, 0xc0009bad00, 0xc0017a52c0, 0xc000a42780) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:513 +0x1a4 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:486 +0x461 goroutine 3088 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc00099b1a0, 0xc00099b200, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 3118 [chan receive]: www.velocidex.com/golang/velociraptor/services/repository.(*ArtifactRepositoryPlugin).Call.func1(0xc000b3b810, 0xc0017accc0, 0xc000fd7e00, 0x1ed9540, 0xc000a42b80, 0xc000a7c080) /home/mic/projects/velociraptor/services/repository/plugin.go:196 +0xb5c created by www.velocidex.com/golang/velociraptor/services/repository.(*ArtifactRepositoryPlugin).Call /home/mic/projects/velociraptor/services/repository/plugin.go:76 +0xba goroutine 3119 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc000aea440, 0x1ed9540, 0xc000a42b80, 0xc00167e140, 0xc000fde0c0) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f goroutine 3115 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc000a42280, 0x1ed9540, 0xc000a42b80, 0xc000fd7e00, 0xc0017acba0) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f goroutine 3154 [chan receive]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func1(0xc000fde1e0, 0x1ed9540, 0xc000a42b80, 0xc0004743c0, 0xc000aea2c0) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:513 +0x1a4 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:486 +0x461 goroutine 3159 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc000fde420, 0xc000fde480, 0x1ed9540, 0xc000aea480) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 3108 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc0009e1e40, 0x1ed9540, 0xc000a42b80, 0xc000fd7cc0, 0xc0017ac840) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f goroutine 3109 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc0017ac900, 0xc000b0cc60, 0xc000fd7cc0, 0x1ed9540, 0xc000a42b80) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1215 +0x58e created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 3160 [chan receive]: www.velocidex.com/golang/vfilter._ForeachPluginImpl.Call.func1.1() /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/foreach.go:90 +0xf7 www.velocidex.com/golang/vfilter._ForeachPluginImpl.Call.func1(0xc000fde540, 0xc0004748c0, 0xc000aea540, 0x1ed9540, 0xc000aea480) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/foreach.go:105 +0x4a8 created by www.velocidex.com/golang/vfilter._ForeachPluginImpl.Call /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/foreach.go:24 +0x8b goroutine 3156 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc000fde240, 0xc000fde2a0, 0x1ed9540, 0xc000aea480) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 3142 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc00099b3e0, 0xc00099b440, 0x1ed9540, 0xc000a42b80) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 3086 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc000a42b40, 0x1ed9540, 0xc0009bad00, 0xc0017a4640, 0xc00099b140) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f goroutine 3155 [chan receive]: www.velocidex.com/golang/vfilter.(*_Select).Eval(0xc000aea100, 0x1ed9540, 0xc000aea480, 0xc0004748c0, 0x2a84c870) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:653 +0x18b www.velocidex.com/golang/vfilter.(*_StoredQuery).Eval(0xc000a4d350, 0x1ed9540, 0xc000aea480, 0xc0004743c0, 0xc000a4d350) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/stored.go:54 +0x61 www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc000fde2a0, 0xc000a4d8c0, 0xc0004743c0, 0x1ed9540, 0xc000aea480) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1151 +0xb42 created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 3121 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc000fde120, 0xc000fde180, 0x1ed9540, 0xc000a42b80) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 3111 [select]: www.velocidex.com/golang/vfilter._ForeachPluginImpl.Call.func1(0xc0017ac9c0, 0xc000fd7cc0, 0xc0009e1e80, 0x1ed9540, 0xc000a42b80) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/foreach.go:42 +0x2a1 created by www.velocidex.com/golang/vfilter._ForeachPluginImpl.Call /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/foreach.go:24 +0x8b goroutine 3139 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc00099b2c0, 0xc00099b320, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 3083 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc00099af00, 0xc000ad2cf0, 0xc000659900, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1215 +0x58e created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 3125 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc000fde060, 0xc000fde300, 0x1ed9540, 0xc000a36180) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 3081 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc00099ad80, 0xc00099ade0, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 3084 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc00099aea0, 0xc00099af00, 0x1ed9540, 0xc0009bad00) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 3168 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc002d80060, 0xc002d800c0, 0x1ed9540, 0xc000a36180) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 3120 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc000fde180, 0xc000a4dad0, 0xc00167e140, 0x1ed9540, 0xc000a42b80) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1152 +0xb7a created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 3117 [chan receive]: www.velocidex.com/golang/vfilter.(*_From).Eval.func1(0xc0017acc00, 0xc0017acc60, 0x1ed9540, 0xc000a42b80) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1080 +0x8f created by www.velocidex.com/golang/vfilter.(*_From).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1078 +0xb9 goroutine 3124 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc000fde300, 0xc000a4d1d0, 0xc000474c80, 0x1ed9540, 0xc000a36180) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1215 +0x58e created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 3158 [chan receive]: www.velocidex.com/golang/vfilter.(*_Plugin).Eval.func1(0xc000fde480, 0xc000a4d320, 0xc0004748c0, 0x1ed9540, 0xc000aea480) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1215 +0x58e created by www.velocidex.com/golang/vfilter.(*_Plugin).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:1139 +0x8b goroutine 3157 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc000aea500, 0x1ed9540, 0xc000aea480, 0xc0004748c0, 0xc000fde3c0) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f goroutine 3166 [select]: www.velocidex.com/golang/vfilter.(*_Select).Eval.func4(0xc000aea0c0, 0x1ed9540, 0xc000a36180, 0xc000658c80, 0xc002d80000) /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:684 +0x168 created by www.velocidex.com/golang/vfilter.(*_Select).Eval /home/mic/go/pkg/mod/www.velocidex.com/golang/vfilter@v0.0.0-20200915085043-06916b51053e/vfilter.go:679 +0x39f